VOLTA Infostealer Uses AI Models to Rank Stolen Data by Value

Cybersecurity researchers have identified a new Windows infostealer called VOLTA-AUTODOXER, or VOLTA, that uses large language models to rank a victim's stolen data by its monetization value.

According to Cisco Talos researcher Ryan Fetterman, the malware assembles a structured evidence bundle about the person behind the machine, covering geolocation, employer, inferred birth year, card digits, Slack workspaces, document metadata, and a live Roblox account valuation. It also searches the victim's Gmail for receipts from services such as Amazon, DoorDash, and PayPal to corroborate a home address.

That bundle is sent through OpenRouter to Anthropic's Claude Opus 4.6 by default, falling back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash if a model refuses, with responses checked for refusal phrases before moving down a chain of up to three models. A 240-word system prompt casts the model as a forensic intelligence analyst and requires output sections including "WHAT THEY'RE WORTH," ranking valuables by monetization tier, and "THEIR OPSEC," assessing security posture and password hygiene.

Stolen data is exfiltrated over Telegram in three stages: after the stealer runs, after the AI call, and after live enrichment. Talos said the build-time template suggests the author may be selling a builder kit or compiling custom binaries per order. "The axis of AI improvement here is not speed or scale but effort displacement," Talos said.

Source: The Hackers News