INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

VOLTA malware uses LLM to rank stolen data by value

| 2026-11-02 05:51 CRITICAL HIGH DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
US
cryptocurrencycryptocurrency financefinance
Incident Timeline
‎2026/10/26
Threat actors utilizing the VOLTA infostealer, integrated with AI tools Claude, Gemini, and Kimi, ranked victims by financial value.
tactic Ransomware
Last week, Talos also detailed an AI-enabled framework called NIK C2 that gives attackers remote access, credential theft, keylogging, defense evasion, surveillance, and ransomware capabilities, while integrating an OpenAI client to send stolen data for AI analysis within the compromised session.
tactic Keylogging
Last week, Talos also detailed an AI-enabled framework called NIK C2 that gives attackers remote access, credential theft, keylogging, defense evasion, surveillance, and ransomware capabilities, while integrating an OpenAI client to send stolen data for AI analysis within the compromised session.
organisation OpenAI
Last week, Talos also detailed an AI-enabled framework called NIK C2 that gives attackers remote access, credential theft, keylogging, defense evasion, surveillance, and ransomware capabilities, while integrating an OpenAI client to send stolen data for AI analysis within the compromised session.
‎2026/11/02
Threat actors used the VOLTA infostealer malware, which leverages AI systems like Claude, Gemini, and Kimi to rank victims by financial value.
organisation Discord, Steam
" Data exfiltration happens over Telegram at three different stages - Right after the stealer runs, containing details about browser passwords, cookies, payment cards, cryptocurrency wallets; Discord, Steam, and Roblox tokens; Wi-Fi passwords, and screenshots After the AI call, which includes the captured data and the results of the LLM analysis After the live enrichment step, which in…
infrastructure Windows
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value.
A Go-based, Windows remote access tool, NIK C2 grants persistent control over compromised hosts and supports over 52 commands sent by a command-and-control (C2) server to collect a wide range of data.
"If the victim has configured an OpenAI account on their machine, that account's API key will be used to fund the actor's AI inference." "NIK C2 reshapes adversary tradecraft by collapsing collection and exploitation into a single continuous session, effectively erasing the offline processing delays that historically granted defenders critical detection windows," Talos said.
organisation Financial Value
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value.
organisation Chromium
Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots.
organisation Slack
Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots.
organisation Discord
Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots.
organisation Telegram
Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots.
organisation Microsoft
Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots.
organisation Amazon
" To make this information more valuable, the malware uses stolen session access to search the victim's Gmail account for receipts to corroborate the home address by extracting emails related to Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal.
organisation DoorDash
" To make this information more valuable, the malware uses stolen session access to search the victim's Gmail account for receipts to corroborate the home address by extracting emails related to Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal.
organisation Walmart
" To make this information more valuable, the malware uses stolen session access to search the victim's Gmail account for receipts to corroborate the home address by extracting emails related to Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal.
organisation PayPal
" To make this information more valuable, the malware uses stolen session access to search the victim's Gmail account for receipts to corroborate the home address by extracting emails related to Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal.
organisation OpenRouter
Once the necessary information is collected, the bundle is serialized and fed into an artificial intelligence (AI) system for analysis using OpenRouter, a unified LLM API gateway and routing service, along with a system prompt.
organisation Google
The requests are defaulted to Anthropic's Claude Opus 4.6, failing which it falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash.
organisation Zscaler ThreatLabz
"GenAI technologies are also well suited to examine massive amounts of data for the purposes of classification or content searching," Zscaler ThreatLabz said .
organisation LLMjacking
This is a form of LLMjacking, where bad actors steal access to another party's AI model to run their own operations – in this case, against the victim itself – while the legitimate owner pays for the computing power.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value.
A Go-based, Windows remote access tool, NIK C2 grants persistent control over compromised hosts and supports over 52 commands sent by a command-and-control (C2) server to collect a wide range of data.
"If the victim has configured an OpenAI account on their machine, that account's API key will be used to fund the actor's AI inference." "NIK C2 reshapes adversary tradecraft by collapsing collection and exploitation into a single continuous session, effectively erasing the offline processing delays that historically granted defenders critical detection windows," Talos said.
Intelligence Sources
The Hacker News 2026-11-02