New VOLTA infostealer uses Claude, Gemini and Kimi to rank victims by financial value
Cisco Talos researchers identified a new infostealer called VOLTA that doesn't stop at harvesting passwords, cookies, cryptocurrency wallets and Discord or Telegram sessions, but feeds everything it steals into a large language model for analysis. Through OpenRouter, a service that provides unified access to multiple AI models, VOLTA first asks Anthropic's Claude Opus 4.6 to build a profile of each victim covering home address, employer, estimated age and even a Roblox account valuation, falling back to Kimi K2 or Gemini 2.5 Flash if the model refuses. To corroborate the home address, the malware searches the victim's own Gmail account for receipts from Amazon, DoorDash or PayPal. The case shows that commercial AI services have become a working part of the pipeline criminals use to monetize stolen data, something worth knowing for any business weighing what kind of access to customer or staff data flows through its AI API keys.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.