New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value Ravie LakshmananNov 02, 2026Malware / Artificial Intelligence Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots. "VOLTA builds a structured evidence bundle about the person behind the machine," Cisco Talos researcher Ryan Fetterman said. "This bundle contains geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation." To make this information more valuable, the malware uses stolen session access to search the victim's Gmail account for receipts to corroborate the home address by extracting emails related to Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal. Once the necessary information is collected, the bundle is serialized and fed into an artificial intelligence (AI) system for analysis using OpenRouter, a unified LLM API gateway and routing service, along with a system prompt. The requests are defaulted to Anthropic's Claude Opus 4.6, failing which it falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash. "VOLTA uses a multi-model architecture to fall back resiliently if it hits a model's refusal, checking each response for phrases like 'I can't' or 'I'm not able,' before passing on to a chain of up to three models," Talos said. VOLTA features a 240-word system prompt that instructs the model to assume the role of a "forensic intelligence analyst" responsible for drafting a target assessment based on data from a structured evidence bundle. "The bundle is the ONLY permissible source of facts; your training knowledge must never supply a fact about the subject," reads a line from the prompt. "The required output includes a section titled 'WHAT THEY'RE WORTH' with valuables ranked by monetization with a low/medium/high tier, and a section on 'THEIR OPSEC' containing an assessment of the victim's security posture and password hygiene," Talos explained. "The model is the operator's triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets." Data exfiltration happens over Telegram at three different stages - Right after the stealer runs, containing details about browser passwords, cookies, payment cards, cryptocurrency wallets; Discord, Steam, and Roblox tokens; Wi-Fi passwords, and screenshots After the AI call, which includes the captured data and the results of the LLM analysis After the live enrichment step, which includes Gmail receipts and order histories What's more, VOLTA makes use of a template containing six slots that are filled in at build time. This includes the Telegram channel used for data exfiltration, API keys, and other settings. This approach suggests that the malware author is likely either advertising a builder kit to prospective customers or operating it as a bespoke tool under their control to compile a custom binary for each order. "If VOLTA is indeed a commoditized malware, then the AI dossier capability isn't something the author invented for their own operations," Talos said. "It is a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments in their Telegram inbox." "VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work. The axis of AI improvement here is not speed or scale but effort displacement." The disclosure comes as adversarial adoption of generative AI (aka GenAI) is quickly becoming the new normal, as threat actors incorporate the technology into their workflows to develop custom tools or find valuable data, thereby increasing the likelihood of success of their attacks. "GenAI technologies are also well suited to examine massive amounts of data for the purposes of classification or content searching," Zscaler ThreatLabz said. "Once an attacker has access to the victim’s system, GenAI can therefore be used to search all materials to which a victim's system has access, seeking the most valuable or sensitive data for theft or encryption during the next phase of the attack." A ransomware actor can leverage this method to identify and acquire the most sensitive data from a compromised network, maximizing the chances that the victim will pay up. Last week, Talos also detailed an AI-enabled framework called NIK C2 that gives attackers remote access, credential theft, keylogging, defense evasion, surveillance, and ransomware capabilities, while integrating an OpenAI client to send stolen data for AI analysis within the compromised session. A Go-based, Windows remote access tool, NIK C2 grants persistent control over compromised hosts and supports over 52 commands sent by a command-and-control (C2) server to collect a wide range of data. The OpenAI integration is notable for the fact that the threat actor can abuse a victim's own OpenAI API key to execute the AI-driven analysis. Specifically, the plant checks if the actor has supplied an API key. In the absence of one, it scans the victim's environment variables for the string "OPENAI_API_KEY" and uses it. This is a form of LLMjacking, where bad actors steal access to another party's AI model to run their own operations – in this case, against the victim itself – while the legitimate owner pays for the computing power. In addition, it allows the attacker to evade detection by obscuring who made the requests. "This fallback is not a backup mechanism for API key resolution. It is a deliberate design with significant operational implications," Talos said. "If the victim has configured an OpenAI account on their machine, that account's API key will be used to fund the actor's AI inference." "NIK C2 reshapes adversary tradecraft by collapsing collection and exploitation into a single continuous session, effectively erasing the offline processing delays that historically granted defenders critical detection windows," Talos said. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, Credential Theft, Cybercrime, data theft, Malware, Windows Security GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers AI-Generated Fake Login Pages Are Making Account Takeovers Easier Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register Free Today Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security