Cisco Talos Finds AI-Assisted Malware VOLTA

Cisco Talos said on the 31st, in a post on its official blog, that it found VOLTA-AUTODOXER, a Windows infostealer that steals personal information and uses AI models to assess victims’ asset value and security posture. The malware automatically switches to another model if an AI model refuses to analyze the data or gives an insufficient response.

VOLTA collects passwords and cookies stored in infected PCs’ browsers, payment card details, email and messaging accounts, and cryptocurrency wallets. It can also obtain Microsoft authentication tokens, cloud service access details, and screenshots. Using stolen accounts to inspect victims’ online activity, it searches Gmail for receipts from Amazon, PayPal, and delivery services to find home addresses and spending histories, and collects Uber Eats and DoorDash order records. For Roblox items, it checks external market prices to estimate their monetary value.

The malware sends the collected information to an AI model and asks it to rank victims’ assets as low, medium, or high in potential cash value. It assigns the AI the role of a “forensic information analyst” and is designed to produce reports assessing password management and security for use in further attacks. Talos said traditional infostealers focused on sending data to attackers, while VOLTA links information across services to analyze its economic value and potential for further attacks. This automates work attackers might otherwise do by examining personal information themselves.

VOLTA connects to external model services through OpenRouter. Its default model is Anthropic’s Claude Opus 4.6; if a request is refused or the response is insufficient, it calls Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash. Talos noted that the fallback feature anticipates refusals triggered by models’ safety safeguards.

AI analysis runs on the infected PC, not on the attacker’s server. The malware uses the victim’s internet connection to send information to a model, then sends the analysis results along with the original data to the attacker through services such as Telegram. It may delete itself after running. Telegram channels and API keys can be configured for each buyer, allowing them to receive analysis reports without a separate server, but Talos said it had not confirmed whether VOLTA was actually being sold. Talos said AI does not directly break into systems or decide what to steal; it assesses the value of stolen information and helps select targets.

Cisco Talos said on the 31st, in a post on its official blog, that it found VOLTA-AUTODOXER, a Windows infostealer that steals personal information and uses AI models to assess victims’ asset value and security posture. The malware automatically switches to another model if an AI model refuses to analyze the data or gives an insufficient response.

VOLTA collects passwords and cookies stored in infected PCs’ browsers, payment card details, email and messaging accounts, and cryptocurrency wallets. It can also obtain Microsoft authentication tokens, cloud service access details, and screenshots. Using stolen accounts to inspect victims’ online activity, it searches Gmail for receipts from Amazon, PayPal, and delivery services to find home addresses and spending histories, and collects Uber Eats and DoorDash order records. For Roblox items, it checks external market prices to estimate their monetary value.

The malware sends the collected information to an AI model and asks it to rank victims’ assets as low, medium, or high in potential cash value. It assigns the AI the role of a “forensic information analyst” and is designed to produce reports assessing password management and security for use in further attacks. Talos said traditional infostealers focused on sending data to attackers, while VOLTA links information across services to analyze its economic value and potential for further attacks. This automates work attackers might otherwise do by examining personal information themselves.

VOLTA connects to external model services through OpenRouter. Its default model is Anthropic’s Claude Opus 4.6; if a request is refused or the response is insufficient, it calls Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash. Talos noted that the fallback feature anticipates refusals triggered by models’ safety safeguards.

AI analysis runs on the infected PC, not on the attacker’s server. The malware uses the victim’s internet connection to send information to a model, then sends the analysis results along with the original data to the attacker through services such as Telegram. It may delete itself after running. Telegram channels and API keys can be configured for each buyer, allowing them to receive analysis reports without a separate server, but Talos said it had not confirmed whether VOLTA was actually being sold. Talos said AI does not directly break into systems or decide what to steal; it assesses the value of stolen information and helps select targets.