Cybersecurity researchers have found a brand new Home windows infostealer malware known as VOLTA-AUTODOXER (aka VOLTA) that makes use of a giant language mannequin (LLM) to rank a sufferer’s stolen information by their monetization worth.
Like different typical stealer households, VOLTA is provided to reap passwords and cookies from Chromium-based net browsers; information from Outlook profiles and Slack workspaces; cost playing cards; cryptocurrency pockets seed phrases; Discord, Telegram, Steam, and Roblox classes; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots.
“VOLTA builds a structured proof bundle concerning the individual behind the machine,” Cisco Talos researcher Ryan Fetterman mentioned. “This bundle accommodates geolocation and residential deal with, employer and employer area, inferred delivery 12 months, card last-4 digits, Slack workspaces, doc authorship metadata, iPhone backup indicators, and a stay Roblox account valuation.”
To make this info extra useful, the malware makes use of stolen session entry to go looking the sufferer’s Gmail account for receipts to corroborate the house deal with by extracting emails associated to Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal.
As soon as the mandatory info is collected, the bundle is serialized and fed into a synthetic intelligence (AI) system for evaluation utilizing OpenRouter, a unified LLM API gateway and routing service, together with a system immediate. The requests are defaulted to Anthropic’s Claude Opus 4.6, failing which it falls again to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash.
“VOLTA makes use of a multi-model structure to fall again resiliently if it hits a mannequin’s refusal, checking every response for phrases like ‘I can not’ or ‘I am not in a position,’ earlier than passing on to a sequence of as much as three fashions,” Talos mentioned.
VOLTA includes a 240-word system immediate that instructs the mannequin to imagine the function of a “forensic intelligence analyst” liable for drafting a goal evaluation primarily based on information from a structured proof bundle. “The bundle is the ONLY permissible supply of info; your coaching information mustn’t ever provide a reality concerning the topic,” reads a line from the immediate.
“The required output features a part titled ‘WHAT THEY’RE WORTH’ with valuables ranked by monetization with a low/medium/excessive tier, and a bit on ‘THEIR OPSEC’ containing an evaluation of the sufferer’s safety posture and password hygiene,” Talos defined.
“The mannequin is the operator’s triage analyst; it turns a uncooked credential log right into a prioritized and citation-backed file of the sufferer and their monetizable property.”
Information exfiltration occurs over Telegram at three completely different phases –
- Proper after the stealer runs, containing particulars about browser passwords, cookies, cost playing cards, cryptocurrency wallets; Discord, Steam, and Roblox tokens; Wi-Fi passwords, and screenshots
- After the AI name, which incorporates the captured information and the outcomes of the LLM evaluation
- After the stay enrichment step, which incorporates Gmail receipts and order histories
What’s extra, VOLTA makes use of a template containing six slots which are crammed in at construct time. This consists of the Telegram channel used for information exfiltration, API keys, and different settings.
This strategy means that the malware writer is probably going both promoting a builder package to potential clients or working it as a bespoke device underneath their management to compile a customized binary for every order.
“If VOLTA is certainly a commoditized malware, then the AI file functionality is not one thing the writer invented for their very own operations,” Talos mentioned. “It’s a function which permits a buyer of any degree of sophistication to level it at victims and begin receiving ranked goal assessments of their Telegram inbox.”
“VOLTA is a mature stealer with a late-stage AI layer added for one objective: relieving the operator of analytical work. The axis of AI enchancment right here shouldn’t be pace or scale however effort displacement.”
The disclosure comes as adversarial adoption of generative AI (aka GenAI) is shortly turning into the brand new regular, as menace actors incorporate the expertise into their workflows to develop customized instruments or discover useful information, thereby growing the chance of success of their assaults.
“GenAI applied sciences are additionally effectively suited to look at huge quantities of knowledge for the needs of classification or content material looking out,” Zscaler ThreatLabz mentioned. “As soon as an attacker has entry to the sufferer’s system, GenAI can subsequently be used to go looking all supplies to which a sufferer’s system has entry, searching for probably the most useful or delicate information for theft or encryption in the course of the subsequent part of the assault.”
A ransomware actor can leverage this methodology to determine and purchase probably the most delicate information from a compromised community, maximizing the probabilities that the sufferer can pay up.
Final week, Talos additionally detailed an AI-enabled framework known as NIK C2 that provides attackers distant entry, credential theft, keylogging, protection evasion, surveillance, and ransomware capabilities, whereas integrating an OpenAI consumer to ship stolen information for AI evaluation inside the compromised session.
A Go-based, Home windows distant entry device, NIK C2 grants persistent management over compromised hosts and helps over 52 instructions despatched by a command-and-control (C2) server to gather a variety of knowledge.
The OpenAI integration is notable for the truth that the menace actor can abuse a sufferer’s personal OpenAI API key to execute the AI-driven evaluation. Particularly, the plant checks if the actor has provided an API key. Within the absence of 1, it scans the sufferer’s setting variables for the string “OPENAI_API_KEY” and makes use of it.
It is a type of LLMjacking, the place unhealthy actors steal entry to a different get together’s AI mannequin to run their very own operations – on this case, towards the sufferer itself – whereas the professional proprietor pays for the computing energy. As well as, it permits the attacker to evade detection by obscuring who made the requests.
“This fallback shouldn’t be a backup mechanism for API key decision. It’s a deliberate design with important operational implications,” Talos mentioned. “If the sufferer has configured an OpenAI account on their machine, that account’s API key might be used to fund the actor’s AI inference.”
“NIK C2 reshapes adversary tradecraft by collapsing assortment and exploitation right into a single steady session, successfully erasing the offline processing delays that traditionally granted defenders crucial detection home windows,” Talos mentioned.
