Volta malware uses AI to rank stolen data by financial value

Cybersecurity researchers at Cisco Talos have identified a new Windows infostealer named VOLTA-AUTODOXER, or VOLTA, which integrates large language models to assess the financial value of stolen user data. Discovered in early November 2026, this malware represents a shift in criminal tradecraft by automating the analysis phase of data theft.

What happened

VOLTA operates as a sophisticated information stealer, targeting a wide array of sensitive assets from compromised Windows machines. It harvests credentials and session tokens from Chromium-based browsers, Outlook profiles, Slack workspaces, and various gaming platforms including Discord, Steam, and Roblox. The malware also extracts payment card details, cryptocurrency wallet seed phrases, Microsoft OAuth tokens, SSH keys, cloud provider credentials, Wi-Fi profiles, and screenshots.

Beyond simple collection, VOLTA constructs a detailed profile of the victim. It gathers geolocation data, home addresses, employer information, inferred birth years, and document metadata. To verify this information, the malware accesses the victim’s Gmail account to search for receipts from services like Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal. This enrichment step allows the attacker to corroborate physical addresses and assess spending habits.

The collected data is serialized into a structured evidence bundle and sent to an AI system for analysis. The malware uses OpenRouter, a unified API gateway, to query large language models. It defaults to Anthropic’s Claude Opus 4.6 but includes fallback mechanisms to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash if the primary model refuses the request. This multi-model approach ensures the analysis completes even if one provider blocks the malicious prompt.

How it works

The core innovation of VOLTA lies in its use of a 240-word system prompt that instructs the AI to act as a "forensic intelligence analyst." The prompt strictly limits the model to using only the provided evidence bundle, preventing it from relying on pre-trained knowledge. The AI is tasked with producing a dossier that includes a section titled "WHAT THEY'RE WORTH," which ranks assets by monetization potential into low, medium, or high tiers. It also generates a section called "THEIR OPSEC" to evaluate the victim’s security posture and password hygiene.

Data exfiltration occurs in three distinct stages over Telegram. The first stage happens immediately after execution, sending raw credentials, cookies, and screenshots. The second stage follows the AI analysis, transmitting the enriched data along with the LLM-generated assessment. The final stage occurs after live enrichment, delivering Gmail receipts and order histories. This staged approach allows attackers to prioritize high-value targets quickly without waiting for all data to be processed.

The malware uses a build-time template with six slots for configuration, including the Telegram channel for exfiltration and API keys. This structure suggests VOLTA may be distributed as a builder kit or compiled as a bespoke tool for specific orders. By automating the triage process, the malware displaces the analytical effort from the human operator to the AI model, allowing less sophisticated actors to efficiently identify lucrative victims.

Key details

• VOLTA uses OpenRouter to access LLMs, defaulting to Claude Opus 4.6 with fallbacks to Kimi K2 and Gemini 2.5 Flash.
• The AI system prompt restricts the model to using only the stolen data bundle, prohibiting external knowledge.
• Data is exfiltrated in three stages via Telegram: initial steal, post-AI analysis, and post-enrichment.
• The malware searches Gmail for receipts from major retailers to verify home addresses and assess financial status.
• VOLTA targets a broad range of applications, including browsers, Slack, Discord, Steam, Roblox, and cloud providers.
• The build template suggests the tool may be available as a commodity builder kit for other cybercriminals.

Why it matters

For software engineers and security leads, VOLTA illustrates how generative AI is moving from experimental use to operational integration in cybercrime. The malware does not just steal data; it processes it to reduce the cognitive load on attackers. This "effort displacement" means that threat actors can scale their operations without needing deep analytical skills, as the AI handles the prioritization of targets. Defenders can no longer assume that stolen data will sit idle; it may be instantly analyzed for maximum impact.

The use of multiple LLM providers with fallback logic demonstrates a resilient architecture designed to bypass safety refusals. By checking for phrases like "I can't" or "I'm not able," VOLTA ensures continuity of service. This adaptability makes it harder for security vendors to block AI-driven attacks by simply restricting access to a single model. Organizations must consider that their own data could be used to train or refine these adversarial workflows if proper isolation is not maintained.

What you can do

• Audit and rotate API keys stored in environment variables to prevent LLMjacking and unauthorized AI usage.
• Implement strict egress filtering to detect and block unusual outbound traffic to Telegram or unknown API endpoints.
• Enforce multi-factor authentication on all critical accounts, especially email and cloud services, to limit session hijacking.
• Monitor for unusual AI API calls from internal networks, particularly those originating from user workstations rather than backend services.
• Educate users about the risks of storing sensitive receipts and financial documents in easily accessible email folders.
• Review and restrict permissions for applications accessing Gmail and other productivity suites to minimize data exposure.