Cisco Talos has uncovered a new malware family called VOLTA-AUTODOXER, also known as VOLTA, that uses a large language model to rank stolen data by monetization value. The malware behaves like a conventional stealer in many ways, but its real twist is the added AI layer that turns raw theft into a structured assessment. Instead of stopping at passwords and cookies, it tries to build a dossier that tells the operator what the victim is worth.
VOLTA’s theft scope is wide. It targets passwords and cookies from Chromium-based browsers, data from Outlook profiles and Slack workspaces, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots. Cisco Talos researcher Ryan Fetterman said the malware “builds a structured evidence bundle about the person behind the machine,” and that bundle can include geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation.
The malware does not rely on stolen data alone. It also uses session access to search the victim’s Gmail account for receipts that can help confirm the home address, pulling emails tied to Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal. That enrichment step feeds into an AI analysis pipeline built around OpenRouter, a unified LLM API gateway and routing service. The default model is Anthropic’s Claude Opus 4.6, with fallback to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash if needed.
Talos says VOLTA uses a multi-model architecture that keeps trying if a model refuses, checking for phrases like “I can’t” or “I’m not able” before moving on to another model in a chain of up to three. The system prompt is about 240 words long and tells the model to act as a “forensic intelligence analyst” drafting a target assessment from a structured evidence bundle. One line makes the boundary explicit: “The bundle is the ONLY permissible source of facts; your training knowledge must never supply a fact about the subject.”
The output format is just as deliberate. Talos says the model is instructed to produce a section titled “WHAT THEY’RE WORTH” with valuables ranked by monetization using low, medium, and high tiers, along with a section called “THEIR OPSEC” that assesses the victim’s security posture and password hygiene. In Talos’s words, the model becomes “the operator’s triage analyst,” converting a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.
Data leaves the system in stages. First, right after the stealer runs, it sends browser passwords, cookies, payment cards, cryptocurrency wallets, Discord, Steam, and Roblox tokens, Wi-Fi passwords, and screenshots. After the AI call, it sends the captured data plus the LLM analysis. After the live enrichment step, it sends Gmail receipts and order histories.
VOLTA also appears to be built from a template with six slots filled in at build time, including the Telegram channel used for exfiltration, API keys, and other settings. Talos says that suggests the malware author may be selling a builder kit to customers or operating a bespoke tool that compiles a custom binary for each order. If it is commoditized malware, then the AI dossier feature is a capability available to customers of any skill level, letting them point it at victims and get ranked target assessments in Telegram.
That pattern fits a broader shift Talos and other researchers are seeing. Adversarial use of generative AI is becoming routine, with threat actors using it to build custom tools and locate valuable data. Zscaler ThreatLabz says GenAI can be used to search large amounts of accessible material for sensitive data that can be stolen or encrypted later, and ransomware operators can use it to identify the most sensitive data in a compromised network.
Talos also recently detailed NIK C2, an AI-enabled framework that offers remote access, credential theft, keylogging, defense evasion, surveillance, and ransomware capabilities while integrating an OpenAI client to analyze stolen data inside the compromised session. The Go-based Windows RAT supports more than 52 commands from a C2 server, and it can even use a victim’s own OpenAI API key if one is present in environment variables under OPENAI_API_KEY. Talos describes that as LLMjacking, where attackers steal access to another party’s AI model and make the victim pay for the inference while obscuring who is making the requests.
Licensed under CC BY-ND 4.0 International