VOLTA malware uses AI to grade victims' financial value

VOLTA stands out because it automates a step attackers previously did by hand: sorting through stolen data to decide who is worth pursuing. By sending an Identity_Report.txt to AI models through OpenRouter, it turns a pile of credentials and personal details into a ranked list of victims, complete with an assessment of their security habits.

The malware also anticipates that AI models may decline the request. Its fallback chain — Claude Opus 4.6, then Kimi K2, then Gemini 2.5 Flash — suggests attackers are designing around safety refusals, a pattern Cisco Talos expects may spread to other malware. The analysis runs on the victim's own PC, with results compressed and sent to the attacker, so the attacker receives a tidy summary rather than raw files.

Cisco Talos also points to a possible sales model in which customers receive customized versions of the malware. If that model takes hold, AI-assisted triage of stolen data could become a product feature rather than a one-off trick.