Cybercriminals have begun leveraging advanced artificial intelligence models, including Anthropic’s Claude, Google’s Gemini, and Moonshot AI’s Kimi, to evaluate the financial potential of their victims, particularly those holding cryptocurrencies. This development marks a significant evolution in cyberattack tactics, as outlined in a recent report by Cisco Talos.
VOLTA malware uses AI to identify high-value victims
Cisco Talos researchers described a new strain of Windows malware, named VOLTA-AUTODOXER or simply VOLTA, that not only steals sensitive information but also utilizes AI models to analyze and rank the data it gathers. Unlike conventional infostealer malware that primarily targets passwords and access credentials, VOLTA is programmed to scrutinize the stolen information in depth, seeking out victims whose assets may yield higher profits for attackers.
A key capability of VOLTA is its ability to extract and process cryptocurrency wallet details, including recovery seed phrases. This enables attackers to potentially seize control of digital assets stored on compromised systems. The malware’s design also allows it to target crypto wallet vaults directly, which increases the risk for individuals who keep wallet information on their computers.
In addition to targeting cryptocurrencies, VOLTA is equipped to gather a wide range of data types. As detailed by Ryan Fetterman, a security researcher at Cisco Talos, the malware can capture saved browser credentials, payment card information, authentication tokens, and email logins. It is capable of intercepting active sessions on popular platforms such as Telegram, Discord, Steam, and Roblox.
Comprehensive data extraction and AI-driven profiling
VOLTA can also extract details from Outlook accounts, Slack workspaces, and other personal or work-related information stored on the infected device. The malware goes further by scanning email accounts and searching for digital receipts and purchase confirmations from services including Amazon, PayPal, Walmart, DoorDash, and Uber Eats. This layer of analysis allows threat actors to develop comprehensive profiles of victims, including their identities, addresses, employment information, and spending habits.
Once data collection is complete, VOLTA sends the information to AI models accessible via the OpenRouter service. The malware initially tries to process the data using Anthropic’s Claude Opus 4.6. If a request is denied, the malware is programmed to attempt processing with Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash, following a specific order and verifying model availability and response.
The AI models are tasked with evaluating each victim’s financial worth, pinpointing the most valuable assets, and even ranking potential earnings for attackers. VOLTA can also instruct the AI to assess a victim’s cybersecurity defenses, aiding hackers in prioritizing which victims to target further.
Through integration with top AI tools, malicious actors can automate the process of sifting through large volumes of stolen data and efficiently identify the most profitable victims and assets.
This method eliminates much of the manual labor typically required in cyberattacks, enabling threat actors to operate at scale and with greater precision.
With AI-driven attacks increasingly capable of quickly identifying high-value crypto wallets, users face heightened risks. CryptoAppsy‘s real-time coin-specific news alerts and customizable portfolio tracking provide an effective way for individuals to monitor changes to their digital assets and receive timely signals about emerging threats related to their holdings. By enabling instant awareness, CryptoAppsy can help users stay vigilant as cyber risks continue to evolve.
