New VOLTA stealer hands your stolen data to AI, asks it to pick the richest victims

Key points

• Cisco Talos researchers disclosed VOLTA-AUTODOXER, a Windows infostealer that sends what it steals to a commercial AI model and asks the model to rank victims by how much money they are worth.
• If one AI service refuses the request, the malware automatically tries two more, a sign the authors expected safety guardrails and engineered around them.
• The malware has no attacker-owned servers and deletes itself after running, which makes clean-up harder and takedowns almost pointless.
• Stolen material includes browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases and active sessions for Discord, Telegram, Steam, Roblox, Outlook and Slack.
• VOLTA is the first case we've seen where the AI step is central to the business model, not just a feature on a sales page.

A new piece of Windows malware does something most stealers don't. After emptying your browser and your crypto wallet, it uploads the loot to a commercial AI chatbot and asks which victim on today's list looks richest.

The malware is called VOLTA-AUTODOXER. Cisco Talos described it in a writeup published on their blog under a research project the team calls CAIRN. This is the third piece of Talos-flagged AI-assisted malware we've covered since September, following CLOSEDQUORUM and the four-model voting sample Talos published the same day.

What does VOLTA actually do to a victim?

It steals the usual things, then it ranks you. On an infected Windows PC the malware grabs saved passwords and cookies from Chromium-based browsers (Chrome, Edge and Brave among them), payment card details, cryptocurrency wallet seed phrases, and live login sessions for Discord, Telegram, Steam, Roblox, Outlook and Slack.

That haul is bundled into a structured report and sent to a large language model (an AI that powers public chatbots) with a prompt asking it to score each victim's assets by how easily they convert to cash. The operator then picks the fattest targets by hand. It's a junior analyst's job, outsourced to somebody else's AI, for free.

Why does the AI not refuse?

Sometimes it does. Talos says VOLTA is wired to a three-model chain: when one service blocks the request on safety grounds the malware fails over to the next, then the next. That fallback isn't an accident. It tells you the authors tested their prompts against guardrails and built around them.

Talos hasn't published a working list of which specific vendors are being abused in live samples. The engineering pattern, though, is clear: assume refusal, route around it.

What makes this different from a normal stealer?

Two things matter more than the AI gimmick on its own.

The critical failure mode is the absence of attacker infrastructure. There's no command-and-control box to seize, no panel to deface, no hosting provider to lean on. Defenders are used to killing stealers by killing their servers. You can't kill a prompt.

Should you worry?

Treat this like any other stealer, because the theft itself is well-understood. If you use a Windows PC for banking or crypto, the practical steps are the same ones security teams have pushed since 2022.

Turn on multi-factor authentication (a second check such as a code or a phone prompt) on every account that offers it. Don't store crypto seed phrases in a browser or a notes app. Keep Windows and your browser current. If your machine has been acting strangely, assume saved passwords are gone and change the important ones from a different device.

For the operations crowd: if your detection strategy still relies on spotting traffic to known-bad command-and-control domains, VOLTA is exactly the shape of the thing that walks straight past it.