Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim’s stolen data by their monetization value.
Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots.
“VOLTA builds a structured evidence bundle about the person behind the machine,” Cisco Talos researcher Ryan Fetterman said. “This bundle contains geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation.”
To make this information more valuable, the malware uses stolen session access to search the victim’s Gmail account for receipts to corroborate the home address by extracting emails related to Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal.
Once the necessary information is collected, the bundle is serialized and fed into an artificial intelligence (AI) system for analysis using OpenRouter, a unified LLM API gateway and routing service, along with a system prompt. The requests are defaulted to Anthropic’s Claude Opus 4.6, failing which it falls back to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash.
“VOLTA uses a multi-model architecture to fall back resiliently if it hits a model’s refusal, checking each response for phrases like ‘I can’t’ or ‘I’m not able,’ before passing on to a chain of up to three models,” Talos said.
VOLTA features a 240-word system prompt that instructs the model to assume the role of a “forensic intelligence analyst” responsible for drafting a target assessment based on data from a structured evidence bundle. “The bundle is the ONLY permissible source of facts; your training knowledge must never supply a fact about the subject,” reads a line from the prompt.
“The required output includes a section titled ‘WHAT THEY’RE WORTH’ with valuables ranked by monetization with a low/medium/high tier, and a section on ‘THEIR OPSEC’ containing an assessment of the victim’s security posture and password hygiene,” Talos explained.
“The model is the operator’s triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.”
Data exfiltration happens over Telegram at three different stages –
- Right after the stealer runs, containing details about browser passwords, cookies, payment cards, cryptocurrency wallets; Discord, Steam, and Roblox tokens; Wi-Fi passwords, and screenshots
- After the AI call, which includes the captured data and the results of the LLM analysis
- After the live enrichment step, which includes Gmail receipts and order histories
What’s more, VOLTA makes use of a template containing six slots that are filled in at build time. This includes the Telegram channel used for data exfiltration, API keys, and other settings.
This approach suggests that the malware author is likely either advertising a builder kit to prospective customers or operating it as a bespoke tool under their control to compile a custom binary for each order.
“If VOLTA is indeed a commoditized malware, then the AI dossier capability isn’t something the author invented for their own operations,” Talos said. “It is a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments in their Telegram inbox.”
“VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work. The axis of AI improvement here is not speed or scale but effort displacement.”
The disclosure comes as adversarial adoption of generative AI (aka GenAI) is quickly becoming the new normal, as threat actors incorporate the technology into their workflows to develop custom tools or find valuable data, thereby increasing the likelihood of success of their attacks.
“GenAI technologies are also well suited to examine massive amounts of data for the purposes of classification or content searching,” Zscaler ThreatLabz said. “Once an attacker has access to the victim’s system, GenAI can therefore be used to search all materials to which a victim’s system has access, seeking the most valuable or sensitive data for theft or encryption during the next phase of the attack.”
A ransomware actor can leverage this method to identify and acquire the most sensitive data from a compromised network, maximizing the chances that the victim will pay up.
Last week, Talos also detailed an AI-enabled framework called NIK C2 that gives attackers remote access, credential theft, keylogging, defense evasion, surveillance, and ransomware capabilities, while integrating an OpenAI client to send stolen data for AI analysis within the compromised session.
A Go-based, Windows remote access tool, NIK C2 grants persistent control over compromised hosts and supports over 52 commands sent by a command-and-control (C2) server to collect a wide range of data.
The OpenAI integration is notable for the fact that the threat actor can abuse a victim’s own OpenAI API key to execute the AI-driven analysis. Specifically, the plant checks if the actor has supplied an API key. In the absence of one, it scans the victim’s environment variables for the string “OPENAI_API_KEY” and uses it.
This is a form of LLMjacking, where bad actors steal access to another party’s AI model to run their own operations – in this case, against the victim itself – while the legitimate owner pays for the computing power. In addition, it allows the attacker to evade detection by obscuring who made the requests.
“This fallback is not a backup mechanism for API key resolution. It is a deliberate design with significant operational implications,” Talos said. “If the victim has configured an OpenAI account on their machine, that account’s API key will be used to fund the actor’s AI inference.”
“NIK C2 reshapes adversary tradecraft by collapsing collection and exploitation into a single continuous session, effectively erasing the offline processing delays that historically granted defenders critical detection windows,” Talos said.
