cyber.hendryadrian.com
Security News · thehackernews.com

VOLTA Infostealer Uses AI to Rank Victims’ Stolen Data by Value

· Original article ↗

Summary

Talos researchers say the VOLTA Windows infostealer collects credentials and personal data, then uses LLMs to rank victims’ assets by monetization value. It reportedly sends exfiltrated data over Telegram.

Key points

  • Talos says VOLTA steals browser credentials, payment and cryptocurrency data, messaging and gaming sessions, OAuth tokens, SSH and cloud keys, and other information.
  • The malware reportedly combines stolen data with location, employment, and other personal details to build a victim profile, including by searching Gmail for receipts.
  • VOLTA sends the collected evidence bundle through OpenRouter to Claude Opus 4.6 by default, with Kimi K2 and Gemini 2.5 Flash as fallbacks if a model refuses.
  • Its AI-generated assessment ranks assets by monetization value and evaluates the victim’s security posture and password hygiene.
  • VOLTA reportedly exfiltrates data over Telegram; its build-time template includes the exfiltration channel and API keys.
  • Talos separately described NIK C2, a Windows remote access tool that can use an API key found in a victim’s environment to analyze stolen data, potentially charging the victim’s account.

Article Details

Event Type
Discovery of VOLTA-AUTODOXER (VOLTA), a Windows infostealer that uses LLMs to assess the monetization value of stolen victim data; the article also describes Talos's reporting on the NIK C2 remote-access framework.
Impact
VOLTA can steal credentials, session cookies, payment and cryptocurrency data, tokens, keys, communications data, and screenshots, then use AI to rank assets and assess victims' security posture. The article says stolen data is exfiltrated through Telegram. NIK C2 can enable remote access, credential theft, keylogging, and AI analysis using a victim's OpenAI API key, potentially charging the legitimate account owner.

MITRE ATT&CK

T1056.001 · KeyloggingNIK C2 is reported to support keylogging.T1113 · Screen CaptureVOLTA collects screenshots.T1528 · Steal Application Access TokenVOLTA collects Microsoft OAuth tokens.T1539 · Steal Web Session CookieVOLTA harvests browser session cookies.T1552.004 · Private KeysVOLTA collects SSH keys.T1555.003 · Credentials from Web BrowsersVOLTA harvests passwords from Chromium-based web browsers.

People

Ryan FettermanCisco Talos researcher quoted describing VOLTA's collection of victim evidence and its AI-based assessment of stolen data.

Malware

VOLTA-AUTODOXERCybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value.

Vendors

Anthropicunified LLM API gateway and routing service, along with a system prompt. The requests are defaulted to Anthropic's Claude Opus 4.6, failing which it falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash.Googleare defaulted to Anthropic's Claude Opus 4.6, failing which it falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash.Moonshot AIprompt. The requests are defaulted to Anthropic's Claude Opus 4.6, failing which it falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash.OpenAItheft, keylogging, defense evasion, surveillance, and ransomware capabilities, while integrating an OpenAI client to send stolen data for AI analysis within the compromised session.OpenRouterthe bundle is serialized and fed into an artificial intelligence (AI) system for analysis using OpenRouter, a unified LLM API gateway and routing service, along with a system prompt. The requests are defaulted

Products

Claude Opus 4.6gateway and routing service, along with a system prompt. The requests are defaulted to Anthropic's Claude Opus 4.6, failing which it falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash.Gemini 2.5 Flashto Anthropic's Claude Opus 4.6, failing which it falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash.Kimi K2The requests are defaulted to Anthropic's Claude Opus 4.6, failing which it falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash.OpenRouterthe bundle is serialized and fed into an artificial intelligence (AI) system for analysis using OpenRouter, a unified LLM API gateway and routing service, along with a system prompt. The requests are defaultedTelegramfrom Outlook profiles and Slack workspaces; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and

Tools

NIK C2Last week, Talos also detailed an AI-enabled framework called NIK C2 that gives attackers remote access, credential theft, keylogging, defense evasion, surveillance, and ransomware capabilities, while integrating an

Related Articles