Volta malware adds AI analysis to profile victims and prioritize targets

Cisco Talos researchers have identified an infostealer called Volta-Autodoxer that sends stolen information to language models to build victim assessments, WIRED reports. The malware collects credentials, authentication tokens, payment information and account sessions, then examines central accounts such as Gmail for further details about victims' locations and habits. It uses OpenRouter to request analysis, defaulting to Claude Opus 4.6 with fallbacks to Kimi K2 and Gemini 2.5 Flash. The assessments seek details about victims' activities, wealth and security practices. Talos did not track whether Volta has been used in the wild, and its credential-stealing functions work without AI.