VOLTA AI‑Powered Infostealer Harvests Credentials, Tokens and Personal Data, Then Uses LLMs to Rank Victims
What Happened — Cisco Talos identified a new Windows infostealer dubbed VOLTA‑AUTODOXER. The malware first steals a broad set of credentials and personal data—including browser passwords, cookies, payment‑card details, OAuth tokens, SSH keys, cloud‑service credentials, Wi‑Fi passwords, cryptocurrency wallet seeds and session tokens for Slack, Discord, Telegram, Steam, Roblox and other services. After collection, VOLTA hands the loot to a large‑language model (LLM) that builds a structured profile of the victim (location, employer, recent purchases, value of gaming accounts, etc.) and ranks the target’s monetary worth for the attacker. The malware self‑deletes after execution and relies on third‑party infrastructure rather than attacker‑controlled C2 servers.
Why It Matters for Trust & Control Assurance — The campaign highlights the need for strong credential protection and continuous monitoring of data‑exfiltration activities, a core control area that underpins many compliance frameworks.
Who Is Affected — Any organization whose employees use Windows workstations and the listed consumer apps (e.g., finance, retail, media, technology, education).
Recommended Actions
- Enforce multi‑factor authentication and credential‑vaulting for privileged accounts.
- Deploy endpoint detection and response (EDR) with behavior‑based detection for unknown infostealers.
- Implement data‑loss‑prevention (DLP) policies that monitor outbound flows of credential‑type data.
- Conduct regular security‑awareness training on phishing and malicious downloads.
Source: Cisco Talos Report
Technical Notes
- Platform: Windows (self‑deleting executable).
- Data collected: passwords, cookies, payment‑card numbers, OAuth tokens, SSH keys, cloud credentials, Wi‑Fi profiles, crypto wallet seeds, screenshots, gaming‑account values.
- AI component: LLM used to rank victim value; no attacker‑controlled C2 server.
- Delivery vector: not publicly disclosed, but typical infostealer vectors include phishing attachments and malicious downloads.
Source: Cisco Talos Analysis