VOLTA Infostealer: When AI Helps Attackers Choose Their Best Victims

Cybersecurity researchers have identified a new Windows infostealer malware called VOLTA-AUTODOXER, also referred to as VOLTA, which incorporates large language model AI tools, including Claude, Gemini, and Kimi, to automatically assess and rank stolen data according to its likely financial value. As The Hacker News reports, VOLTA harvests passwords and cookies from Chromium-based browsers, data from Outlook profiles, and content from Slack workspaces, alongside a broader range of personal and financial information including credit card details and session tokens. Wired has also covered the malware, noting that it collects data from Discord sessions and food delivery accounts, building a detailed picture of each victim that the AI then uses to prioritise which individuals are most worth targeting for follow-on fraud or extortion.

Why this matters for UK organisations

The use of AI to automate post-theft data triage is a meaningful development in the infostealer landscape. Traditionally, attackers harvesting data from large numbers of compromised machines would need to manually sift through stolen information to identify the most valuable targets. By automating this process, VOLTA allows operators to scale their activity more efficiently, focusing resources on the victims most likely to yield financial return. For UK organisations, the inclusion of Outlook and Slack data in VOLTA's collection scope is directly relevant, as both are standard tools across most business environments. Compromised employee credentials from these platforms can provide attackers with access to internal communications, sensitive documents, and further authentication tokens that extend the reach of an initial compromise well beyond the affected machine.

What to review

Organisations should review whether endpoint detection and response tooling is capable of identifying infostealer-class malware, and confirm that browser-stored credentials are flagged as a risk in employee awareness training. Password manager policies and the use of browser-native credential storage should be assessed, particularly for accounts with access to sensitive systems. Multi-factor authentication across Outlook, Slack, and other collaboration tools provides an important additional layer of protection even if credentials are stolen. It is also worth reviewing whether privileged accounts are subject to additional controls that would limit the damage if a standard employee machine were compromised by a tool of this type.

Source: The Hacker News