A newly identified infostealer malware called VOLTA reportedly uses commercial AI models, including Claude, Gemini, and Kimi, to decide which stolen data is most valuable to attackers.
New infostealer · VOLTA
VOLTA uses commercial AI models to decide which stolen data is worth the most
Reporting describes a newly identified infostealer that ranks harvested passwords, cookies, and crypto wallet data by likely value, verifies victim details in Gmail, and sends AI-generated dossiers through Telegram.
How the reported pipeline works
STEP 1
Collect
Passwords, cookies, and crypto wallet data from infected systems
→
STEP 2
Verify
Check Gmail receipts to confirm purchases, accounts, and identifiers
→
STEP 3
Rank
AI models score which stolen data is most valuable to attackers
→
STEP 4
Dossier
AI-generated target profiles built for each victim
→
STEP 5
Relay
Dossiers sent via Telegram, a channel criminal groups often use
What the reporting describes
Commercial AI models, including Claude, Gemini, and Kimi, are used for triage
Stolen data is ranked by likely worth, not treated equally
Gmail receipts help judge whether credentials are current
Telegram carries the AI-generated dossiers
What remains unknown
Number of victims affected
Organizations or regions targeted
How widely VOLTA has spread
How the malware is delivered
Where defenders are looking
Detecting or restricting third-party model traffic is the new front line.
Network
Which AI services VOLTA contacts, and how
Account
Whether third-party model use can be restricted per account
Providers
Abuse monitoring and misuse prevention for widely available tools
Recommended user actions
Use multi-factor authentication
Monitor for unexpected account activity
Rotate credentials after suspected compromise
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...