599/69 Tuesday, November 3, 2026
Researchers from Cisco Talos have reported the discovery of a Windows information-stealing malware known as VOLTA, or VOLTA-AUTODOXER, which incorporates Artificial Intelligence (AI) into its operations. In addition to stealing personal, system, and financial information in a conventional manner, the malware uses Large Language Models (LLMs) to automatically assess the financial value of victims and prioritize targets. This approach reflects an emerging trend in which cybercriminals use AI to reduce the amount of manual analysis required, allowing attackers to identify potentially high-value victims more quickly and systematically.
VOLTA follows a four-stage workflow. It first collects sensitive information such as identity and financial data, then organizes the stolen information and submits it to AI systems for analysis. The AI is instructed to act as an analyst, generating a personal profile, estimating the victim’s potential value, and assessing the victim’s operational security practices. The malware primarily uses Claude Opus 4.6, with Kimi K2 and Gemini 2.5 Flash as fallback models if errors occur. The analysis is performed from the victim’s machine using the victim’s own internet connection. The malware then packages the stolen data together with the AI-generated report and sends it to the attackers through Telegram. Researchers also found that VOLTA is designed to bypass Chrome’s App-Bound encryption protections.
Administrators should consider implementing application control policies to restrict or alert on unknown processes attempting to interact with Google Chrome. Users who suspect that a system may be compromised can perform an initial check for a file named volta_debug.txt in %APPDATA%, which is used by the malware as a debug log. If compromise is confirmed, all access tokens should be revoked and passwords changed immediately. Users who store cryptocurrency wallets or related credentials on the affected device should consider moving assets to a newly created wallet generated on a trusted offline device. For longer-term protection, organizations and users should also consider moving sensitive authentication material to hardware-backed credential management solutions.