VOLTA malware uses AI to rank stolen data by value

Cisco Talos says a Windows infostealer called VOLTA uses artificial intelligence to assess stolen information and rank a victim’s assets by potential value to criminals. The malware, which calls itself VOLTAAUTODOXER, adds an optional profiling step after collecting data, turning the haul into a structured target assessment rather than leaving operators to review it manually. Talos says VOLTA can collect browser passwords, cookies and saved payment-card details, along with cryptocurrency wallet seed phrases, account sessions, Microsoft OAuth tokens, SSH and cloud-service keys, Wi-Fi profiles and screenshots. It also targets accounts and sessions associated with services including Discord, Telegram, Steam and Roblox. The malware can use a victim’s authenticated sessions to gather further details, such as purchase receipts and delivery-service order histories, which may help establish an address or identify valuable digital assets. The collected information is assembled into a profile and sent through OpenRouter to an AI model. According to Talos, the prompt directs the model to act as a forensic intelligence analyst, rank assets by how readily they could be monetized, and...