New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value

Live updates

1. 1h ago

   VOLTA Infostealer Uses AI Models to Rank Victims by Financial Value

   Cybersecurity researchers discovered VOLTA-AUTODOXER, a Windows infostealer that uses Claude, Gemini, and Kimi AI via OpenRouter to prioritize stolen data based on monetization value. The malware harvests a wide array of credentials, including Chromium browser data, cryptocurrency seed phrases, and Slack workspaces. It compiles a structured evidence bundle for each target, which AI then ranks by financial worth. Once the assessment is complete, the payload may delete itself to avoid detection. Exfiltration of the final data occurs over Telegram.

   Why it matters

   Traditional stealers typically collect bulk data for manual sorting or sale. VOLTA automates the appraisal process, allowing attackers to identify high-value targets immediately. This shift leverages commercial large language models to turn raw stolen data into actionable financial dossiers.

   What is confirmed

   • VOLTA-AUTODOXER is a Windows infostealer that uses Claude, Gemini, and Kimi AI to rank victims by financial value.
   • The malware utilizes OpenRouter to access commercial AI models for data analysis.
   • Stolen data is exfiltrated via Telegram.
   • VOLTA harvests passwords and cookies from Chromium browsers, Outlook profiles, Slack workspaces, and cryptocurrency wallet seed phrases.
   • The malware can switch AI models if one refuses a request or skip the AI step entirely.
   • The payload may delete itself after completing the victim assessment.
   • Cisco Talos researcher Ryan Fetterman stated that VOLTA builds a structured evidence bundle including geolocation, home address, employer domain, and live Roblox account valuations.

   What to watch next

   • Evidence of AI model providers blocking OpenRouter requests linked to VOLTA
   • Identification of the specific threat actor group operating the VOLTA infrastructure
   Sources used for this update (12)

   1. WIRED — Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims
   2. Cisco Talos Blog — Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
   3. Tom's Hardware — New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely
   4. mezha.net — VOLTA malware asks Claude to rank victims’ valuables, then may delete itself
   5. The Hacker News — New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
   6. thehackernews.com — New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to ...
   7. aimultiple.com — Benchmark of 90+ LLMs in Finance: Claude Opus 5.5 & Gemini 4 Argon
   8. www.realground.com — New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to ...
   9. dailysecurityreview.com — Talos: VOLTA Infostealer Uses Claude and Gemini to Rank ...
   10. techmediaglobal.com — VOLTA Infostealer Uses Claude, Gemini and Kimi AI to Rank ...
   11. hamerintel.com — New VOLTA Infostealer Uses Consumer AI Models to Supercharge…
   12. aviatrix.ai — VOLTA Infostealer Uses Claude, Gemini & Kimi AI to Rank ...
   confidence 100%