Cybersecurity researchers have discovered a Windows infostealer known as VOLTA-AUTODOXER, or VOLTA, which uses large language models to analyze stolen information and rank victims according to their potential financial value.
The malware can collect passwords and cookies from Chromium-based browsers, Outlook and Slack data, payment cards, cryptocurrency wallet seed phrases, and sessions for Discord, Telegram, Steam, and Roblox. It also targets Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots.
According to Cisco Talos researcher Ryan Fetterman, VOLTA creates a structured evidence bundle describing the person using the compromised computer. The bundle may include geolocation and home-address information, the employer and its domain, an inferred birth year, the last four digits of payment cards, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live valuation of a Roblox account.
The malware also uses stolen session access to search Gmail for receipts and order-related emails from services including Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal. This information can help corroborate a victim’s address and add context to the collected profile.
After gathering the data, VOLTA serializes the evidence bundle and submits it through OpenRouter, an API gateway for routing requests between large language models. The malware defaults to Anthropic’s Claude Opus 4.6 and can fall back to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash if a model refuses the request.
Talos said the malware checks model responses for refusal phrases before moving through a chain of up to three models. Its system prompt instructs the selected model to act as a forensic intelligence analyst and to use only the information contained in the evidence bundle.
The requested analysis includes a section ranking assets by monetization potential using low, medium, and high categories, as well as an assessment of the victim’s security posture and password hygiene. Talos described the model as a triage analyst that transforms a credential log into a prioritized dossier for the operator.
VOLTA exfiltrates information over Telegram in three stages. The first transmission takes place after execution and includes browser credentials, cookies, payment-card and cryptocurrency data, selected service tokens, Wi-Fi passwords, and screenshots. A second transmission follows the AI analysis and contains both the captured information and the model’s results. A final transfer can include Gmail receipts and order histories collected during the enrichment stage.
The malware uses a build-time template with six configurable slots, including the Telegram channel used for exfiltration, API keys, and other settings. Talos said this could indicate that its creator is offering a builder kit or producing customized binaries for individual customers.
The researchers said that, if VOLTA is being distributed as a commodity malware, its AI dossier feature could allow operators with limited expertise to receive ranked assessments of victims directly in Telegram. They characterized the AI layer as a way to reduce the amount of analysis required from the operator rather than simply improving speed or scale.
The findings reflect a broader use of generative AI by threat actors to classify stolen information and identify valuable data. Zscaler ThreatLabz has warned that attackers could use AI after compromising a system to search accessible materials for sensitive information to steal or encrypt, potentially strengthening extortion attempts.
Cisco Talos also recently described NIK C2, a Go-based Windows remote-access tool with more than 52 commands for functions such as remote control, credential theft, keylogging, surveillance, defense evasion, and ransomware operations. The framework includes an OpenAI client that can submit stolen data for analysis.
NIK C2 can use an attacker-provided OpenAI API key or search the victim’s environment variables for “OPENAI_API_KEY.” Talos described this as a form of LLMjacking, in which an attacker uses another party’s AI access and resources for malicious operations. If a victim has configured an OpenAI account on the machine, its key could be used to pay for the attacker’s requests and make attribution more difficult.
Sources: The Hacker News.