Subscribe
, ,

Malware now asks AI to pick its victims: what it means for you

AIooze Editorial

In one minute

  • You will understand what Cisco Talos found in the VOLTA malware and why it matters to ordinary computer users.
  • You need: your computer or phone and about 20 minutes to check your most important accounts.
  • The single most important habit: protect key accounts with a password manager plus two-step verification or passkeys.

What happened

Cisco Talos, Cisco’s threat research team, reported on 31 October 2026 that it had found a Windows infostealer (malware that steals saved passwords, cookies and other data) called VOLTA. According to Talos, VOLTA takes browser passwords, cookies, saved payment cards, crypto wallet data and messaging logins, then sends a summary to commercial AI models, which profile the victim and rank the stolen items by likely value. Talos describes it as “a mature stealer implant with an optional AI-integration layer” and gives no figures on how widespread it is.

Why it matters to you

Sorting through stolen data used to take criminals time. If an AI model does the sorting, your most valuable logins (email, bank, shopping) can be picked out and used faster. The good news: the defences are the same basics as before. They simply matter more now.

What to do

  1. Use a password manager to create a different strong password for each account. CISA recommends strong passwords and a password manager.
  2. Turn on two-step verification (also called multi-factor authentication) for email and banking first, as both the UK NCSC and CISA advise. Where a site offers passkeys (sign-ins that use your device instead of a password), the NCSC recommends choosing them over passwords.
  3. Keep Windows, your browser and your apps updated, ideally automatically. CISA says: “Don’t delay software updates.”
  4. Only download software from sources you trust. The FTC warns against using unfamiliar websites to download free music, films or games, and against clicking ads to download software.
  5. If you think your device is infected, the FTC says to stop logging into online accounts until the device is secured, run a scan with updated security software, then change your passwords and turn on two-step verification.
  6. After changing passwords, log out other devices and apps from the account, and check for unauthorised activity, changed security settings and new email forwarding rules, as the NCSC advises. Check bank statements for purchases you did not make.

A worked example

Say Priya downloads a “free” video editor from a site she found through an ad, and her laptop starts acting oddly. Following the steps above, she stops signing in to accounts, runs a full scan, then uses a clean device to change her email password first, logs out all other sessions and switches on two-step verification. She then does the same for her bank and shopping accounts.

Watch out for

  • Changing passwords on a device that is still infected may hand the new ones straight to the criminals. Clean the device first or use another one.
  • Passwords and recovery phrases saved in a plain text file are easy pickings. Talos advises treating a crypto wallet as fully compromised if its recovery phrase was stored that way.
  • Pop-up “your computer is infected” warnings with a phone number are a scam, according to the FTC.

Go deeper

Sources

Related