VOLTA infostealer uses AI to prioritize stolen victim data

Cisco Talos has described VOLTA, a Windows infostealer that adds an AI-analysis stage after collecting victim information. The model is used to prioritize the stolen material and assess its potential value to an operator.

The malware gathers credentials, session information and other data, then constructs a structured bundle for analysis. Talos reports that the implementation can fall back between models when a request is refused. The distinction is useful: the AI layer analyzes collected information; it does not replace the underlying theft mechanisms.

The researchers also describe enrichment using stolen access to online accounts. That can give an attacker a more detailed picture of a victim than a basic password dump alone.

The analysis describes exfiltration over Telegram at different stages, including after collection, AI analysis and account enrichment. It also describes a template-based build design, which Talos assesses may indicate a builder offering or a bespoke tool under its author's control.