AI-Powered VOLTA Infostealer Ranks Victims by Financial Worth
New Windows malware uses LLMs like Claude and Gemini to prioritize stolen data for maximum profit. Targets browsers, email, and messaging apps.
TL;DR
- VOLTA-AUTODOXER is a new Windows infostealer using AI to rank stolen data by financial value.
- It targets Chromium browsers, Outlook, and Slack for credentials and session data.
- Uses LLMs including Claude, Gemini, and Kimi to assess victim data worth.
- Stealer-as-a-service model allows cybercriminals to maximize ROI on compromised accounts.
- Organizations should enhance endpoint detection and user awareness around suspicious downloads.
Cybersecurity analysts have uncovered a sophisticated new infostealer targeting Windows systems, which uniquely employs artificial intelligence to boost its profitability. Dubbed VOLTA-AUTODOXER, this malware not only steals sensitive data but also uses large language models to evaluate and rank victims based on the financial value of their information.
Unlike traditional stealers that simply harvest and dump data, VOLTA introduces a profit-driven approach by leveraging AI services such as Claude, Google's Gemini, and the Chinese model Kimi. This enables attackers to focus on high-value targets, increasing efficiency and return on investment in cybercrime operations.
How VOLTA Operates
- Infects Windows machines through phishing or exploit kits, then deploys data harvesting modules.
- Extracts passwords, authentication tokens, and session cookies from Chromium-based browsers.
- Accesses stored credentials in Outlook profiles and exfiltrates workspace data from Slack.
- Sends collected data to command-and-control servers where it’s processed by integrated LLMs.
- LLMs analyze and score each dataset, helping operators decide which accounts to monetize first.
Implications for Enterprise Security
- Represents evolution in stealer malware toward automation and intelligent data triage.
- Highlights growing threat of AI misuse in cyberattacks beyond deepfakes and social engineering.
- Requires updated endpoint protection strategies that detect behavioral anomalies during data access.
- Emphasizes need for real-time credential monitoring and privileged access management.
- Organizations should train users on identifying malicious downloads and suspicious browser behavior.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.