Cyber ·
VOLTA: infostealer uses an LLM to prioritize stolen victims and assets
Research from the CAIRN initiative, shared through Cisco Talos, describes the VOLTA infostealer, which sends stolen data to a language model to build victim profiles and rank assets by monetization potential.
According to the Cisco Talos report, reproduced in the feed as an automatic translation, VOLTA is a Windows infostealer that deletes itself and adds an AI step to the post-theft workflow. After collecting the usual data set, including browser passwords, cookies, payment cards, wallet seed phrases, messaging and gaming sessions, OAuth tokens and SSH keys, the malware builds an evidence package about the person, with location, employer, inferred birth year and other indicators. It then uses stolen sessions to enrich that package and sends it to a language model with instructions to act as an analyst and write a target assessment. The output includes a section ranking valuable items as low, medium or high, and an assessment of the victim's security posture. According to the report, if a model refuses the task, the malware falls back to a chain of up to three models. The research concludes that the AI does not support a traditional malware function: it performs triage for the operator, turning raw credentials into prioritized dossiers. To consult and verify, read the original post linked by the source and the CAIRN research analyses it cites. The technical details here are summaries of an automatic translation and should be checked against the original.
Original source: Avaliação por IA: priorização de vítimas orientada por modelos no infostealer VOLTA