VOLTA infostealer uses an LLM to rank stolen victim data by monetisation value
AI SECURITYCisco Talosredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
VOLTA, also called VOLTA-AUTODOXER, is a self-deleting Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, chat and gaming sessions, OAuth tokens, SSH and cloud keys, and Wi-Fi passwords. It sends a structured evidence bundle to an LLM via OpenRouter, which produces a ranked target assessment, and falls back to other models if one refuses. The malware also uses stolen sessions to enrich the data, for example by searching Gmail for receipts to confirm a home address.
For IT people · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cisco Talos
Who and what is in it
Malware
Companies