Cisco Talos researchers have described VOLTA, a Windows infostealer that hands part of a criminal’s work to commercial AI models. In a post published on 31 October, Talos says the malware steals browser passwords and cookies, saved payment cards, crypto wallet data, messaging sessions and cloud keys, then asks a large language model to profile the victim and rank the stolen items by how much they could be worth.
The requests go through OpenRouter, a third-party AI gateway. Talos says the default model is Anthropic’s Claude Opus 4.6; if a model refuses, VOLTA falls back to Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash. The AI step is optional, and Talos calls VOLTA “a mature stealer implant with an optional AI-integration layer”. It appears to be sold as a builder kit, with each buyer supplying their own way of spreading it. The sample was first seen on 11 October, and Talos gives no figures on how widespread it is.
Sorting stolen data used to take an attacker’s time and attention. VOLTA shows that step being handed to mainstream AI services.
Talos advises keeping credentials in hardware-backed stores, revoking tokens and changing passwords if infection is suspected, and treating any crypto wallet whose recovery phrase was saved in plain text as compromised. Its post lists indicators for security teams.
Source: Cisco Talos write-up on VOLTA