AI-Powered Windows Malware ‘VOLTA’ Ranks Stolen Data by Monetization Value, Researchers Warn

Cybersecurity researchers have uncovered a sophisticated new Windows infostealer malware named VOLTA-AUTODOXER, commonly referred to as VOLTA, which integrates large language models to autonomously analyze and rank a victim’s stolen data based on its financial monetization potential.

The emergence of VOLTA highlights a shifting paradigm in modern cybercrime, where artificial intelligence is increasingly leveraged not merely to accelerate attacks or scale operations, but to reduce the analytical workload of threat actors. According to insights shared by Cisco Talos researchers, the malware is designed to construct a comprehensive, structured evidence bundle detailing the identity, lifestyle, and digital footprint of the person behind the compromised machine.

Like traditional infostealer families, VOLTA is equipped with comprehensive data-harvesting capabilities. It targets and extracts sensitive information including stored passwords and cookies from Chromium-based web browsers, profile data from Outlook, active Slack workspaces, payment cards, and cryptocurrency wallet seed phrases. Furthermore, the malware captures sessions from major platforms such as Discord, Telegram, Steam, and Roblox, alongside Microsoft OAuth tokens, SSH and cloud-provider keys, local Wi-Fi profiles, and system screenshots.

Cisco Talos researcher Ryan Fetterman explained that VOLTA goes far beyond basic credential collection by compiling a holistic dossier on the victim. This compiled bundle typically includes geolocation data, home addresses, employer details and corporate domains, inferred birth years, the last four digits of payment cards, linked Slack workspaces, document authorship metadata, iPhone backup indicators, and even a live valuation of connected gaming accounts like Roblox.

To substantiate and expand upon these findings, VOLTA utilizes stolen session access to query the victim’s Gmail account for digital purchase receipts. By searching for order confirmations from major consumer and financial platforms such as Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal, the malware corroborates and cross-references the victim’s physical home address and consumer habits.

Once the information-gathering phase concludes, the collected data bundle is serialized and transmitted to an artificial intelligence system for automated analysis. This process is facilitated through OpenRouter, a unified large language model API gateway and routing service, guided by a specialized system prompt. By default, the malware routes requests to Anthropic’s Claude Opus 4.6. If that model encounters restrictions or fails, it systematically falls back to Moonshot AI’s Kimi K2 and subsequently Google’s Gemini 2.5 Flash.

This resilient multi-model architecture ensures that operational momentum is maintained even when facing content moderation or model refusal filters. Talos noted that VOLTA actively checks each model’s response for refusal phrases like "I can’t" or "I’m not able" before passing the evaluation down a chain of up to three distinct models.

Central to VOLTA’s analytical capability is a detailed 240-word system prompt embedded within the malware code. This prompt instructs the artificial intelligence model to adopt the persona of a forensic intelligence analyst tasked with drafting an exhaustive target assessment from the structured evidence bundle. To maintain accuracy and prevent hallucinations, the prompt explicitly mandates that the provided data bundle serves as the exclusive permissible source of facts, prohibiting the model from utilizing its pre-existing training knowledge to introduce external assumptions about the subject.

The required output generated by the AI includes a designated section titled "WHAT THEY’RE WORTH," which categorizes and ranks the victim’s monetizable assets into low, medium, and high value tiers. Additionally, it features a section addressing "THEIR OPSEC," offering a critical evaluation of the victim’s overarching security posture and password hygiene habits. Essentially, the model acts as an automated triage analyst, transforming raw credential logs into a prioritized, citation-backed dossier detailing both the individual and their most valuable digital assets.

Data exfiltration within VOLTA is structured across multiple stages and is primarily channeled through Telegram. The operational framework relies on a configuration template containing six distinct slots populated during the build time of the malware. These slots define specific parameters such as the designated Telegram channel utilized for data exfiltration, necessary API keys, and other functional settings.

This architectural design strongly suggests that the malware author is either commercializing the tool by advertising a builder kit to prospective cybercriminal customers or operating it as a bespoke service under their direct control to compile customized binaries for individual orders. If VOLTA functions as a commoditized piece of malware, it signifies that advanced AI dossier generation capabilities are no longer exclusive to sophisticated threat groups, but are instead accessible to operators with varying technical skill levels who can deploy the tool to receive ranked target assessments directly within their Telegram inbox.

The discovery of VOLTA arrives alongside broader industry warnings regarding the adversarial adoption of generative artificial intelligence. Security firms note that threat actors are rapidly incorporating generative AI into their operational workflows to develop custom tools, automate reconnaissance, and pinpoint high-value data, thereby increasing the probability of successful compromises.

Zscaler ThreatLabz emphasized that generative artificial intelligence technologies are exceptionally well-suited for examining massive repositories of data for classification and content searching. Once an attacker establishes initial access within a victim’s network, generative AI can rapidly scour all accessible materials to identify the most sensitive information for theft or subsequent encryption during ransomware operations. Ransomware actors can effectively leverage this capability to maximize their leverage, ensuring that the acquired data creates maximum pressure on the victim to pay extortion demands.

This trend toward AI integration in malware frameworks is further underscored by recent findings from Cisco Talos detailing an AI-enabled framework known as NIK C2. This Go-based Windows remote access tool provides attackers with persistent control over compromised hosts, supporting over fifty distinct commands issued by a command-and-control server to facilitate credential theft, keylogging, surveillance, defense evasion, and ransomware deployment.

A notable characteristic of the NIK C2 framework is its integration of an OpenAI client, which allows operators to route stolen data for automated AI analysis directly within the compromised session. Furthermore, the framework is designed to abuse the victim’s own OpenAI API key when available. If a dedicated key is not supplied by the operator, the malware scans the victim’s environment variables for the string "OPENAI_API_KEY" and utilizes it to fund the analysis.

This technique represents a form of LLMjacking, wherein malicious actors hijack access to another party’s AI model resources to execute their own operations at the expense of the legitimate account owner, while simultaneously obscuring the origin of the requests to evade detection. Security researchers emphasize that such designs represent a deliberate shift in adversary tradecraft, effectively collapsing the traditional phases of data collection and exploitation into a continuous session that eliminates the offline processing delays historically relied upon by defenders to detect and contain intrusions.