Security researchers at Cisco Talos have uncovered a new piece of AI infostealer malware called VOLTA that does more than grab passwords. After it steals logins, cookies and crypto wallets, it sends a bundle of the victim’s data to a large language model and asks for a written “target assessment.” The result is a ranked dossier that tells an attacker what each victim is worth and how careless they are with security.
What the VOLTA AI Infostealer Does
VOLTA, which calls itself “VOLTA-AUTODOXER” inside its own code, is a self-deleting Windows stealer. Talos found it through CAIRN, a research effort built to spot hacking tools that bake in AI features. The researchers say they have not tracked whether it has been used in real attacks yet.
On its first pass, the malware sweeps up the usual haul. That includes browser passwords, cookies, saved payment cards, crypto wallet seed phrases, Microsoft OAuth tokens, SSH and cloud keys, every saved Wi-Fi password, and screenshots.
It also targets apps that younger, very online users rely on. Discord, Telegram, Steam and Roblox sessions are all on the list, and it even looks up the live value of a victim’s Roblox items.
A Second, Deeper Sweep
What makes VOLTA stand out is what happens next. It reuses the stolen sessions to dig further into the victim’s life, without the victim noticing.
- It searches the victim’s own Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address.
- It pulls order history straight from stolen Uber Eats and DoorDash sessions.
- It reuses the Discord token to fill out the victim’s profile.
- It runs a built-in cracker against crypto wallet vaults and logs which ones it opened.
How the Malware Hands Victim Data to an AI Model
Once the data is collected, VOLTA writes it into a local file, packs it as JSON and posts it to OpenRouter, a service that routes requests to many AI providers. A system prompt tells the model to act as “a forensic intelligence analyst drafting a target assessment.” The required report includes an executive summary, a section on what the person is worth, and a review of their security habits.
The prompt also asks the model to connect scattered clues, such as whether a Wi-Fi password matches the victim’s last name. In other words, the AI is not finding new data. It is stretching the stolen data into useful guesses for the attacker.
Built to Dodge Refusals
The authors clearly expected some models to say no. VOLTA checks replies for phrases like “I can’t” and then moves down a chain of fallback models.
| Step | Model used | Role |
|---|---|---|
| First choice | Anthropic Claude (Opus 4.6, per Wired) | Default analyst |
| Fallback 1 | Moonshot AI Kimi K2 | Used if the first model refuses |
| Fallback 2 | Google Gemini 2.5 Flash | Last AI option in the chain |
| No key present | None | Stealer still works without the AI step |
Talos notes the prompt is carefully worded so it does not sound overtly malicious. The low temperature setting of 0.2 also suggests the attacker wants steady, accurate output rather than creative answers. You can read more about how Anthropic handles misuse in our coverage of Claude distillation defenses.
Why Researchers Call This a Worrying Shift
VOLTA appears to be sold as a kit rather than used by one gang. Talos found a template with six swappable slots for things like a Telegram channel and API keys, filled in for each buyer. That means any customer, skilled or not, could start getting ranked target reports sent to their Telegram inbox.
Talos describes the core idea as “effort displacement.” The slowest human task in a stealer operation is sorting through mountains of stolen logs, and VOLTA hands that job to a model. Faster triage matters because tokens expire and passwords get changed.
This fits a wider pattern. Other researchers have recently reported several hacking groups using AI tools in real intrusions, as we covered in our agentic AI hacking report.
What This Means for You
Infostealers usually arrive hidden in fake or cracked software. The best defense is still basic hygiene, applied consistently.
- Only install software from official stores and real vendor sites, and avoid cracked apps or game cheats.
- Use a password manager instead of saving passwords in your browser, and turn on passkeys or app-based two-factor login where you can.
- If you think you were infected, sign out of all sessions, revoke tokens and change passwords from a clean device.
- Treat any crypto wallet whose seed phrase sat in a plain file as fully exposed, and move funds to a new wallet.
- Keep an eye on kids’ Discord, Steam and Roblox accounts, since this stealer targets them directly.
For IT teams, Talos suggests blocking or alerting on Chrome launched in headless mode by unknown processes, since VOLTA relies on that trick to get past Chrome’s App-Bound Encryption. If a machine is hit, try to keep the file volta_debug.txt in the AppData folder, because it logs exactly what was taken. Our guide on AI threat detection covers how defenders are using the same technology, and a personal cybersecurity assistant can help everyday users stay on top of alerts.
Sources
Primary source: Cisco Talos research on the VOLTA infostealer. Additional reporting from Wired.
Conclusion
VOLTA shows criminals moving AI from writing code to doing the analyst work after a breach. It steals widely, digs deeper using the victim’s own accounts, and then asks a chatbot to rank who is worth targeting first. Its refusal fallback chain also shows attackers planning around AI guardrails from day one. The good news is that the old basics still work: avoid shady downloads, keep passwords out of your browser, and move fast to revoke access if something looks wrong. You can follow more stories like this on our AI news page.
