VOLTA, the infostealer that asks an AI which victims are worth the effort
VOLTA infostealer uses AI to rank victims by financial value after stealing credentials and personal data.
Cisco Talos discovered VOLTA-AUTODOXER, a Windows infostealer that harvests credentials, financial data, and personal information, then submits the stolen data to an LLM via OpenRouter to automatically rank victims by monetization potential and security posture. The malware steals browser credentials, OAuth tokens, cryptocurrency wallets, gaming accounts, and SSH keys, then constructs a detailed victim profile including home address, employer, and financial indicators to help attackers prioritize high-value targets.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cisco?
Get an email when a new story names Cisco, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonVOLTA-AUTODOXER represents a dangerous evolution in infostealer malware by leveraging AI to automatically triage stolen victim data and prioritize high-value targets, dramatically lowering the effort required for attackers to monetize breaches. The malware harvests an extraordinarily broad range of sensitive assets — including browser credentials, OAuth tokens, SSH keys, and cryptocurrency wallets — demonstrating that users routinely store far too much sensitive material in easily-accessible locations. This matters because AI-assisted triage means attackers can now scale targeted attacks that previously required manual analysis, increasing the speed and precision of downstream fraud, identity theft, and account takeovers. End users and organizations that lack credential hygiene, endpoint protection, and monitoring for data exfiltration are acutely exposed to this new class of threat.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — VOLTA-AUTODOXER
- malware — VOLTA