Malware · 1 source · latest 2h

Cisco Talos uncovers VOLTA, an AI-assisted Windows infostealer that ranks victims by value

MALWARECisco Talosredteam/daily · 1 source

Severity: High
Sources: 1

What happened

Cisco Talos has identified VOLTA, a mature, self-deleting Windows infostealer that harvests credentials, sessions and cryptocurrency wallets. It sends a structured evidence bundle to a large language model to rank victims' assets by monetisation value, uses stolen session access to search emails for purchase receipts, and fails over to a multi-model chain if one model refuses. The article says it can bypass Chrome's App-Bound Encryption, lowering the skill needed for low-level attackers.

For IT people · Written by AI from 1 source · Wrong?

What to do

Restrict or alert on processes launching Chrome with the --headless flag.
Store credentials in hardware-backed stores.
Revoke any potentially compromised tokens and change passwords.
If a cryptocurrency wallet's seed phrase was in plaintext on disk, treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device.

Written by AI from the sources, checked against them

Read the full story at the source