Volta Infostealer Uses AI to Rank Stolen Data and Profile Victims

Volta’s most consequential feature may be what it does after stealing data. The infostealer sends a dossier about each infected user to commercial AI models, asking them to assess the person and identify details that could make their accounts especially valuable. That analysis could help attackers decide which stolen credentials or authentication tokens to use first.

Cisco Talos researchers described the malware in a report, naming it “Volta-Autodoxer” after the name it uses internally. Talos identified it with CAIRN, a framework designed to find hacking tools that incorporate AI. Researcher Ryan Fetterman said Talos had not determined whether Volta had been used in real attacks.

A broad collection of personal data

Volta’s underlying function is familiar: it steals information from infected computers, often after being bundled with counterfeit software. It searches for browser-stored passwords, Microsoft OAuth tokens, cookies, payment card details and cryptocurrency wallet seed phrases. It also looks for active sessions on Discord, Telegram, Steam and Roblox. The range suggests a particular interest in people whose online activity spans many services, including gaming and chat platforms.

The malware can use its initial haul to guide a second search. It examines Gmail or another central account to build a more detailed picture of the user, drawing on material such as receipts and order histories from services including UberEats and DoorDash. Fetterman said the collected information is assembled into a serialized dossier before being sent to an AI model.

That distinction matters. A conventional infostealer gives attackers a cache of credentials and account data to sort through. Volta adds an analysis step intended to connect pieces of that data and produce an assessment of the person behind them. Fetterman described the process as asking the model to act like an intelligence analyst and deliver a structured, citation-backed appraisal.

Prompts designed to produce a target assessment

Volta’s creators wrote a prompt of about 240 words to guide that appraisal. It describes the task as drafting a target assessment from an evidence bundle. The model is asked for a summary of the person, what they do, “what they’re worth,” and an account of their operational security. The instructions encourage it to connect information across fields, including checking whether a Wi-Fi password matches the user’s last name. “Go deep, not wide,” the prompt says.

The request is framed in forensic language, rather than explicitly describing criminal use. Fetterman said the prompt appears designed with the possibility of a model refusing in mind. Volta can try another model if its first choice doesn’t comply, and it can still steal data without AI. The model calls add a layer of analysis; they aren’t required for the malware’s basic collection functions.

Model choices and fallback behavior

Volta sends its requests through OpenRouter, which can route prompts to different AI providers. Its default is Anthropic’s Claude Opus 4.6. If that model blocks the request, the malware can try Moonshot AI’s open-weight Kimi K2, followed by Google’s Gemini 2.5 Flash if needed.

This chain makes the system less dependent on a single provider. Fetterman said the developers appear to anticipate refusals and plan to move through models they expect may be more permissive. Attackers also commonly use lower-cost or older-generation models, according to the research. The report doesn’t provide the cost of Volta’s AI calls or explain how often each fallback is used.

Why prioritization can change the risk

Stolen data has a limited useful life. Passwords can be changed, and authentication tokens expire. If the model’s assessment helps an attacker identify the most promising accounts sooner, it may shorten the gap between theft and attempted access. Fetterman said prioritizing targets could improve an attacker’s chance of using credentials or tokens before they stop working.

Infostealers have already supplied credentials used in major breaches. WIRED has reported on incidents tied to stolen logins, including breaches connected to Snowflake that affected AT&T and Ticketmaster, as well as the theft of a terabyte of Disney data. The source article also describes the scale of the wider problem as hundreds of millions of credentials stolen in recent years.

Volta sits within a broader pattern of attackers using large language models to help with coding or to analyze large collections of stolen information. CrowdStrike researchers told WIRED they had observed four distinct hacking groups, working in Chinese, Spanish and English, Indonesian, and Russian, using AI tools in attacks on targets across several industries. That activity spans different levels of technical sophistication; the Volta report does not establish that its users have deployed the malware in the wild.

Fetterman said features in Volta suggest it may have been built for sale to multiple attackers rather than for one specific group. The practical concern is that automated analysis could make detailed victim assessment available to people who would otherwise need to do that sorting themselves. For defenders, the case is a reminder that stolen data can become more useful when software organizes it and surfaces relationships. The key open question is whether Volta’s AI layer is being used in real intrusions—and how much its assessments actually change attackers’ choices.