The VOLTA infostealer uses a large language model after stealing credentials to assess a victim’s potential value to criminals. Cisco Talos reports that the Windows malware, identified as VOLTA-AUTODOXER, assembles collected information into a victim profile and sends it to a model for analysis.
VOLTA turns collected data into target assessments
Stolen information can include browser passwords, session tokens, payment-card details, cryptocurrency wallet data, and credentials for cloud and communication accounts. The malware can also reuse stolen sessions to search for receipts and food-delivery orders, adding address and account details. The model is then asked to rank assets by potential monetization value and assess the victim’s security practices.
AI reduces analysis work, but its broader impact is unclear
Talos says VOLTA has a multi-model fallback chain for refusals and can also operate without an AI call. Here, the model performs intelligence analysis rather than the underlying credential theft, automating a step that would otherwise require an operator to sort through the data. The report suggests the malware may use customizable builds, but that alone does not establish how it is sold or how widely it is used.
For defenders, the concern is that linking stolen records can make them more useful for targeted extortion or fraud. Talos recommends restricting unauthorized processes from launching Chrome in headless mode. After a suspected infection, users should revoke potentially exposed tokens and change passwords; if a wallet seed phrase was stored in plaintext, the wallet should be treated as compromised. Whether AI materially expands criminal operations or mainly lowers the analysis burden remains an open question.