Malware asks AI who is worth robbing: wallets and cards in its sights
Cisco Talos has described VOLTA, a piece of Windows malware that sends stolen data to a language model and has it rank the haul by value.
Criminals are using AI not only to write more convincing phishing emails but to appraise what they steal. Anyone who stores many logins and crypto data on one machine is flagged as a worthwhile target faster.
What happened
Ryan Fetterman, a researcher at Cisco Talos, published the analysis on 31 October; the sample was first seen on 11 October. VOLTA steals passwords and cookies from Chromium browsers, payment cards saved there, seed phrases and data from crypto wallets, Microsoft login tokens, SSH and cloud keys, Wi-Fi passwords and screenshots. It then compiles a dossier: location, employer, estimated year of birth, the last four digits of the card. Using stolen sessions it searches Gmail for purchase receipts to confirm the home address. The bundle is sent via OpenRouter, an intermediary service, to Claude Opus 4.6 by default; if a model refuses, Kimi K2 and Gemini 2.5 Flash follow. The result is a ranking of assets as low, medium or high value. The AI step is optional; without a key the malware still runs. Talos suspects a builder kit sold to customers. It gives no victim numbers. Assessment: AI does not make the theft possible; it makes sorting the loot cheap.
What follows
When appraising stolen data costs almost nothing, volume pays. A single infected company laptop then yields not just passwords but a sorted list of the most valuable access, such as cloud keys and Microsoft tokens. For individuals the risk rises when seed phrases sit in plain text or payment cards in the browser. The switching between models is notable: when one provider refuses, the next steps in. A single vendor's safety filters therefore do little to stop such tools. Assessment: how widespread VOLTA is cannot be read from the analysis; what is established is the pattern, not the scale.
What changes in practice
- Users
- Never store seed phrases as text or in the browser, and review saved payment cards. VOLTA looks for exactly these.
- IT departments
- Talos advises hardware-backed credential storage and alerts when unknown programs launch Chrome in headless mode.
- Companies
- After an infection, revoke tokens and change passwords. The AI ranking tells attackers which corporate access to use first.
What to watch
- Whether Talos or other security firms publish victim numbers
- How OpenRouter and model providers respond to abused keys
- Further malware kits with AI appraisal
Sources
- Cisco Talos: Appraisal by AI – model-driven victim prioritization in the VOLTA infostealer
- The Hacker News: New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims
- GBHackers: VOLTA Infostealer uses AI to profile victims