New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value

Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (also known as VOLTA) that leverages large language models (LLMs) including Claude, Gemini, and Kimi AI to rank stolen victim data by monetization value. Like other stealers, VOLTA harvests passwords and cookies from Chromium-based browsers, as well as data from Outlook profiles and Slack workspaces. The novel use of AI to automatically prioritize and score victims based on their financial value represents a significant evolution in infostealer capability. This automation allows threat actors to efficiently focus their efforts on the most lucrative targets. The malware's integration of multiple commercial AI APIs suggests a well-resourced and technically sophisticated threat actor.