Cisco Talos uncovers VOLTA, an AI-assisted Windows infostealer that ranks victims by value
MALWARECisco Talosredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Cisco Talos details VOLTA, a self-deleting Windows infostealer that uses stolen session access to search victim email for receipts and sends the evidence bundle to an LLM for asset ranking, failing over to a multi-model chain on refusal. The article says it bypasses Chrome's App-Bound Encryption. No CVE IDs or affected versions are given. Defenders should alert on or restrict Chrome processes launched with the --headless flag, enforce hardware-backed credential storage, revoke potentially compromised tokens, and treat wallets with plaintext seed phrases as fully compromised.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Restrict or alert on processes launching Chrome with the --headless flag.
- Store credentials in hardware-backed stores.
- Revoke any potentially compromised tokens and change passwords.
- If a cryptocurrency wallet's seed phrase was in plaintext on disk, treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cisco Talos
Who and what is in it
Malware
Companies
Products