Cybersecurity experts have identified a novel malware, VOLTA-AUTODOXER, also known as VOLTA, which leverages advanced AI technology to assess and rank the value of stolen data. This Windows-based infostealer targets a wide range of personal and financial information, including passwords, cookies, and cryptocurrency wallet details.
Innovative Use of AI in Cyber Threats
Unlike traditional malware, VOLTA incorporates a sophisticated large language model (LLM) to evaluate the financial worth of a victim’s data. This includes credentials from various platforms like Chromium-based browsers, Slack, and even gaming services. According to Ryan Fetterman from Cisco Talos, the malware compiles a detailed dossier, incorporating geolocation, employer details, and other personal data to enhance the monetization assessment.
The malware’s AI-driven analysis is conducted via OpenRouter, utilizing models like Claude Opus 4.6 and others such as Kimi K2 and Gemini 2.5 Flash when needed. This multi-model approach ensures resilience, allowing the malware to adapt if certain AI models are unavailable or refuse requests.
Data Exfiltration and Ransomware Implications
Data is extracted systematically in three stages, initially capturing browser and application credentials, followed by AI analysis results, and lastly, enriched data from services like Gmail. The malware employs Telegram for secure data exfiltration, with customizable settings suggesting that it may be offered as a service kit to other cybercriminals or used by the author to tailor attacks.
VOLTA’s AI capabilities enable even less sophisticated attackers to prioritize targets effectively, receiving detailed assessments of victims’ data directly to their communication channels. This significantly reduces manual analytical efforts, highlighting a shift towards AI-driven automation in cybercrime.
Adapting to the Era of Generative AI
The rise of generative AI is becoming increasingly prevalent in cyber threats, with technologies like GenAI being well-suited for identifying valuable data within vast datasets. Zscaler ThreatLabz notes that once access is gained, such technologies can efficiently target sensitive information for theft or encryption, increasing the likelihood of successful ransomware attacks.
Recent developments include the AI-enabled NIK C2 framework, which enhances attacker capabilities with remote access and data collection features, integrating OpenAI for analyzing stolen data. This exploitation of AI APIs, known as LLMjacking, allows attackers to utilize victims’ resources for their malicious operations without detection.
As AI continues to advance, cybersecurity defenses must evolve to counter these sophisticated threats. The ability of malware like VOLTA to seamlessly integrate AI for data analysis and prioritization represents a significant challenge for security professionals worldwide.
