VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims
Original title: New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims and Rank Stolen Data
The malware outsources victim profiling and asset ranking to commercial AI models after harvesting credentials and sessions.
VOLTA is a self-deleting Windows infostealer that collects browser passwords, cookies, payment cards, cryptocurrency data, and session tokens from Discord, Telegram, Steam, and other apps. After collection it submits a structured bundle to AI models on OpenRouter, instructing them to act as forensic analysts and rank stolen assets by monetization value. The default model is Claude Opus 4.6 with fallbacks to Kimi and Gemini; the malware checks responses for refusal phrases and encrypts customer keys derived from constants in the binary.
- AI analysis produces Identity_Report.txt and AI_Analysis.txt packaged into volta_dox.zip
- Default model anthropic/claude-opus-4.6 with fallbacks to moonshotai/kimi-k2 and google/gemini-2.5-flash
- Collection includes Gmail receipts, Uber Eats sessions, Roblox inventory lookups, and SSH keys
- Defenders should monitor Chrome processes launched with --headless and preserve volta_debug.txt logs
Impact: Automated profiling of stolen credentials and assets by commercial AI models
- 1.Monitor for unexpected Chrome processes with --headless
- 2.Revoke exposed OAuth tokens and sessions
- 3.Preserve volta_debug.txt for analysis
- Vendors
- Cisco Talos
- Malware
- VOLTA
From the original article
3 min read at gbhackers.com
A self-deleting Windows infostealer named VOLTA uses commercial AI models to turn stolen credentials, sessions, and cryptocurrency data into prioritized victim assessments. The malware, self-named “VOLTA-AUTODOXER,” combines extensive collection capabilities with automated identity enrichment.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.