New VOLTA Infostealer Exploits AI Models to Rank Stolen Data by Financial Value

Researchers have discovered a new Windows infostealer malware dubbed VOLTA-AUTODOXER (aka VOLTA) that distinguishes itself by incorporating a large language model (LLM) to rank stolen data by monetization value. According to reporting from The Hacker News, the malware harvests passwords and cookies from Chromium-based web browsers, data from Outlook profiles, and information from Slack workspaces.

The integration of an LLM allows the threat actor to prioritize harvested credentials and data based on perceived financial worth, potentially increasing the efficiency of subsequent fraud or credential stuffing campaigns. The specific AI models referenced in the analysis include Claude, Gemini, and Kimi.

Like other infostealer families, VOLTA targets common productivity and communication platforms. The malware's ability to assess the financial value of stolen data represents a notable evolution in commodity malware techniques, though details regarding the exact implementation of the AI ranking system and the provenance of the models remain subject to ongoing investigation.

The discovery was reported on 2026-11-02. As of now, no specific software patches or vendor advisories have been issued directly addressing VOLTA, as the malware exploits standard credential storage mechanisms within browsers and productivity applications. Security recommendations focus on general infostealer mitigation strategies.