VOLTA malware asks AI how much your data is worth
The Windows infostealer VOLTA steals passwords and crypto wallets — then sends the victim's profile to a language model via OpenRouter, which rates what's worth monetizing.
How VOLTA works
Cisco Talos researchers described the self-propagating Windows infostealer VOLTA-AUTODOXER on October 31. After the classic theft of passwords, cookies, and crypto wallets comes a new step: the malware builds a victim profile and sends it through the OpenRouter API to a language model with instructions to act as a forensic analyst.
The model produces a target assessment — ranking stolen assets by monetary value and rating the victim's security habits. If one model refuses, the malware switches to a chain of three others. The operator no longer has to analyze anything manually; the AI prepares a ranking of the most profitable victims.
Why it's a watershed
Attackers have so far used AI mainly to write phishing. VOLTA raises the bar: AI becomes an operational part of the attack, automating the part that used to require a human analyst. Scaling cybercrime gets a new dimension — out of thousands of victims, the most lucrative ones are selected automatically.
Sources
More news
Google releases Gemini 4 Carbon: a frontier model for cybersecurity
Google's strongest model leads in finding vulnerabilities and fixing them. Access is initially limited to a handful of cyber defenders — a public release will follow later.
Read articleOpenAI releases GPT-6.1 Terra: a cheap model for computer work
The new model at $1 per million input tokens understands the screen, clicks through apps, and writes naturally. It costs a tenth of Astra and handles tasks 9× cheaper than the competition.
Read article