New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
thehackernews.com Nov 3, 2026

New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value

AI-summarised brief · reviewed before publication

Researchers at Cisco Talos have identified a new Windows infostealer, VOLTA‑AUTODOXER (VOLTA), that leverages large‑language models to evaluate the monetary value of stolen data. The malware harvests credentials, cookies, payment cards, cryptocurrency seed phrases, cloud keys, Wi‑Fi profiles and screenshots, then scans Gmail receipts to verify addresses and purchases. Collected data are packaged into a structured “evidence bundle” and sent to an AI routing service (OpenRouter) that queries Anthropic’s Claude Opus 4.6, Moonshot’s Kimi K2 and Google’s Gemini 2.5 Flash in a fallback chain. A 240‑word system prompt instructs the model to act as a forensic analyst, outputting a ranked “WHAT THEY’RE WORTH” list and an “OPSEC” assessment. Results are exfiltrated via Telegram, and the modular template suggests the tool may be sold as a customizable kit to other threat actors.

💡 Why It Matters

  • · By automating victim valuation, VOLTA lets operators prioritize high‑value targets with minimal manual analysis, turning raw credential dumps into actionable, profit‑focused dossiers.