Skip to content
Moojaz — موجز
Search
Menu
HomeRegionsMaghrebAfricaMiddle EastEuropeAsiaAmericasWorldSectionsPoliticsEconomySecurityHealthScienceTechnologyAIEnvironmentCultureSportsSearch
File

VOLTA: data theft and AI profiling

This dossier follows analysis of the VOLTA infostealer, its AI profiling layer and evidence of real-world use.

Last updated : 1 key moments
Padlock over blue circuits.
Cybersecurity illustration from 2018; it does not depict VOLTA malware. — jaydeep_ / Pixabay / Wikimedia Commons — CC0 1.0 https://creativecommons.org/publicdomain/zero/1.0/ — illustration de 2018, sans modification.

Where things stand

As of 31 October 2026, Cisco Talos describes a Windows sample configured to have AI models appraise stolen data. Real-world deployment and victim numbers are not established.

Reported information

Talos describes VOLTA malware configured to have AI appraise stolen data

Cisco Talos published an analysis on 31 October 2026 of VOLTA-AUTODOXER, Windows malware configured to rank a victim’s assets by monetisation value using stolen data. The report describes a sample; no campaign or victim count has been established.

Padlock over blue circuits.
Cybersecurity illustration from 2018; it does not depict VOLTA malware. — jaydeep_ / Pixabay / Wikimedia Commons — CC0 1.0 https://creativecommons.org/publicdomain/zero/1.0/ — illustration de 2018, sans modification.

Researchers say the program collects credentials, sessions and cryptocurrency wallet data, then builds a profile enriched with receipts and order histories. It can send that bundle to a model through OpenRouter for assessment.

Its configuration prioritises Claude Opus 4.6, with Kimi K2 and then Gemini 2.5 Flash as fallbacks after refusals. This describes what the code is set up to do, rather than proving the models accepted requests. Without an API key, theft can continue without the AI step. Talos recommends revoking potentially compromised tokens and changing passwords.

Sources 4