Cybercriminals are using popular artificial intelligence (AI) models like Anthropic's Claude, Google's Gemini and Moonshot AI's Kimi AI to evaluate the financial worth of potential victims, including those owning cryptocurrencies.
Cybersecurity researchers at Cisco Talos detailed in a new report how a new type of Windows malware dubbed VOLTA-AUTODOXER, or simply VOLTA, steals sensitive data and uses AI tools to identify potentially lucrative targets among compromised users.
Compared to traditional information-stealing malware, which mainly steals passwords and credentials, VOLTA can also analyze stolen data to build victim profiles and determine what assets hackers can potentially exploit for profit.
Crypto wallets as top targets
Notably, one of VOLTA's most dangerous features is its ability to extract sensitive crypto wallet information, including recovery seed phrases, which can potentially give attackers access to digital assets.
VOLTA also includes features that can crack cryptocurrency wallet vaults, posing a big risk for people who store their crypto wallet credentials on their computers.
But its features are not just limited to stealing crypto.
As explained by Cisco Talos security researcher Ryan Fetterman, VOLTA can also grab saved browser passwords, payment card info, authentication tokens, email credentials and active sessions on popular platforms like Telegram, Discord, Steam and Roblox.
It can also extract info from Outlook accounts and Slack workspaces, as well as other personal and professional information on the infected system.
The malware also takes things further by analyzing victims' email accounts to grab more personal data.
For example, it can scan Gmail accounts for purchase confirmations and receipts from services like Amazon, PayPal, Walmart, DoorDash and Uber Eats.
This way, attackers can get more details about a victim's identity, home address, job and spending habits.
AI models like Claude, Gemini and Kimi
The malware can send stolen data to AI models via the OpenRouter service, which provides access to several AI models.
It first tries to process the collected data using Anthropic's Claude Opus 4.6.
If the model fails to process the request, VOLTA is hardcoded to try Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash.
As explained by Cisco Talos, VOLTA specifically looks for refusal responses before attempting to use a different AI model.
It feeds the collected data to the AI models and asks them to analyze it, providing a comprehensive evaluation of a victim's financial worth.
It can also help identify valuable assets and then rank them based on how lucrative they may be. It can also score a victim's cybersecurity.
Essentially, it allows hackers to use AI models to find potentially lucrative targets without the need to manually sift through stolen data.
