VOLTA infostealer asks AI which victims are worth targeting

Cisco Talos analyzed a new Windows infostealer named VOLTA (self-named VOLTA-AUTODOXER) that, after stealing data, calls large language models to assess and rank victim value. After running, the malware self-deletes, steals browser passwords, cookies, payment card information, sessions such as Discord and Telegram, and Microsoft OAuth tokens, and must bypass Chrome's App-Bound Encryption. It also uses the victim's session to search Gmail for shopping receipts to confirm the home address, sends the evidence package via the model routing service OpenRouter to large models, and asks for an asset inventory graded by monetization potential and an assessment of the victim's security habits, calling Anthropic's Claude Opus 4.6 by default and, upon detecting a refusal, switching in turn to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash.