Malware · 2h ago
Cisco Talos found VOLTA, a Windows infostealer that ranks stolen data using a chain of up to three AI models and can use an OpenAI API key found on the infected machine, potentially leaving the victim with the analysis bill. Its haul includes browser passwords and sessions, Outlook and Slack data, payment cards, cryptocurrency wallet seed phrases, Microsoft OAuth tokens, and SSH and cloud keys.
VOLTA combines these files and account clues into a profile of the person behind the device. It can search Gmail for purchase receipts to corroborate a home address, then ask an AI model to rank valuables by monetization potential and assess the victim’s security habits. That turns a large credential dump into a dossier operators can use to prioritize targets.
If a Windows endpoint holds work sessions, cloud access, and an API key alongside personal data, one infection can expose all of them—and give attackers a profile for choosing what to exploit. Rotating passwords alone would not resolve possible charges against a stolen API key.
2 sources covering this story
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
VOLTA Windows infostealer uses multiple LLMs to rank stolen data by monetization value and sends AI-generated victim assessments via Telegram.
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
Then, it uses LLMs to profile victims and rank their most valuable assets.
Part of the PlainSec briefing for 2026-11-02