LLM-Powered Infostealer VOLTA Automates Victim Valuation

VOLTA is a Windows infostealer that goes beyond harvesting credentials and session tokens by building detailed financial profiles of its targets. The malware compiles geolocation, home address, employer information, payment card details, Slack workspace memberships, and Roblox account valuations. It leverages access to stolen Gmail accounts to cross-reference purchase receipts from retailers and payment services, strengthening its victim dossiers.

Once assembled, VOLTA sends each profile to a large language model via OpenRouter, defaulting to Anthropic’s Claude Opus 4.6 with fallback options to Kimi K2 and Gemini 2.5 Flash. The model ranks monetizable assets by financial tier and assesses the victim’s security posture, returning a prioritized dossier to the operator via Telegram. The malware likely operates as a commercial builder kit, enabling attackers of any sophistication level to receive ranked target assessments without manual analysis.

The discovery reflects adversarial AI’s growing role in modern malware. Researchers also documented NIK C2, an AI-enabled remote access tool that exfiltrates victims’ OpenAI API keys and uses them to fund its own LLM-driven analysis—a tactic known as LLMjacking. Together, these tools automate historically labor-intensive attack phases and compress the detection windows that defenders previously exploited.