VOLTA Infostealer Uses Claude, Gemini and Kimi AI to Rank Victims
Original title: New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
VOLTA builds evidence bundles and feeds them to Claude Opus 4.6, Gemini 2.5 Flash and Kimi K2 via OpenRouter to generate monetization-ranked Telegram dossiers.
Researchers discovered VOLTA-AUTODOXER, a Windows infostealer that harvests browser credentials, payment cards, crypto seeds, Discord/Telegram/Steam/Roblox tokens, SSH keys, Wi-Fi profiles and screenshots. It constructs a structured bundle including geolocation, address, employer and payment data before using a 240-word prompt to instruct LLMs to act as forensic analysts and output prioritized asset rankings plus opsec assessments. Exfiltration occurs in three stages over Telegram.
- Multi-model fallback checks for refusal phrases before passing to next LLM
- Exfiltrates raw data immediately after infection
- Submits AI analysis results after initial harvest
- Uses build-time templates for Telegram channel and API keys
- Employs LLMjacking-style analysis to obscure requests
Impact: steals credentials, payment cards, crypto wallets and generates ranked victim assessments for fraud
- Malware
- VOLTA-AUTODOXERVOLTA
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces;
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.