New VOLTA Infostealer Uses Claude, Gemini, and Kimi to Rank Victims by Financial Value

Overview

Researchers at Cisco Talos have analysed VOLTA-AUTODOXER (VOLTA), a Windows infostealer that uses a large language model to rank a victim's stolen data by monetization value. Talos describes it as "a mature stealer with a late-stage AI layer" added mainly to cut the operator's analysis workload.

What It Steals

VOLTA is a conventional, broad stealer. It harvests:

• Passwords and cookies from Chromium-based browsers
• Outlook and Slack data, payment cards, and cryptocurrency wallet seed phrases
• Discord, Telegram, Steam, and Roblox sessions
• Microsoft OAuth tokens, SSH keys, and cloud-provider keys
• Wi-Fi profiles and screenshots

It also uses a stolen session to search the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal, which helps corroborate the home address.

The AI Layer

After collection, VOLTA builds a "structured evidence bundle" covering geolocation, home address, employer, inferred birth year, card last-4 digits, and a live Roblox account valuation. It then sends the bundle to an LLM through OpenRouter:

VOLTA checks each response for refusal phrases and moves to the next model if one declines. A 240-word system prompt casts the model as a "forensic intelligence analyst." The required output includes a WHAT THEY'RE WORTH section that ranks valuables as low, medium, or high tier, and a THEIR OPSEC section assessing security posture and password hygiene.

Exfiltration

Data goes to the operator over Telegram in three stages: right after the stealer runs, after the AI call, and after the Gmail enrichment step. A six-slot template (Telegram channel, API keys, other settings) is filled in at build time. That suggests either a builder kit sold to customers or a binary compiled per order.

Related: NIK C2

Talos separately reported NIK C2, a Go-based remote access tool with more than 52 commands and an OpenAI client for analysing stolen data. If no API key is supplied, it reads the victim's OPENAI_API_KEY environment variable and uses it, so the victim pays for the attacker's inference, a form of LLMjacking.

Defensive Takeaways

The source reporting does not include a delivery method, IOCs, or Talos's defensive guidance, so check the original Talos write-up for indicators. General hygiene still applies:

1. Treat any endpoint with a stealer infection as a full credential and session compromise: revoke sessions and OAuth tokens, not just passwords
2. Rotate SSH and cloud keys that were present on the machine
3. Move wallet seed phrases off the endpoint
4. Don't leave long-lived API keys such as OPENAI_API_KEY in user environment variables
5. Monitor for outbound traffic to Telegram and OpenRouter from endpoints that have no business reason to use them

Sources

• The Hacker News — New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value