VOLTA malware steals Gmail and Discord sessions, then uses AI to generate victim profiles

Cisco Talos disclosed a new Windows infostealer, VOLTA: after stealing login sessions for Gmail, Discord and others, it calls AI via OpenRouter to generate an asset valuation report on the victim. The workflow uses Claude Opus 4.6 by default, and when refused, falls back in order to Kimi K2 and Gemini 2.5 Flash; the report rates asset value as low, medium or high and assesses password habits. Talos believes it is sold as a builder, and no attacker-owned server has been found.