VOLTA malware steals data and asks AI to assess the victim

According to the Polish tech site Antyweb, which draws on an analysis by the Cisco Talos team, malware called VOLTA is circulating online. It is an infostealer, a program built to steal information. It has an added analytical layer based on artificial intelligence models.

What VOLTA steals

The program collects passwords saved in browsers, cookies and payment card details. It is especially interested in cryptocurrency wallets. It also goes after messaging accounts, gaming platforms and cloud services. It uses hijacked sessions to pull more data from the user's accounts.

The role of AI

The collected material is packed into a single report and sent to language models through the OpenRouter service. The model is asked to rate the haul as low, medium or high earning potential. It also assesses how carefully the victim handles security and passwords. This helps the operator decide what to deal with first.

The AI also links scattered pieces of information. According to the description, it searches Gmail for Amazon and PayPal purchase confirmations to establish a home address. It analyses Uber Eats and DoorDash order history, which may also point to a workplace. It checks employer details and document properties. If a date of birth is missing, it tries to estimate the year of birth.

The request to the model goes out from the infected computer, and the reply is added to the package of stolen data. The sample was configured to use Claude Opus 4.6. If that model refuses the task, the program can pass it on to Kimi K2 or Gemini 2.5 Flash. Without the AI layer, the stealer still works.

Scale of the threat

The sample was first observed in mid-October 2026. According to Antyweb, the threat appears to be aimed mainly at users in the US. Researchers also found a template with six interchangeable configuration fields. This may mean the program is customised for customers under a "malware as a service" model.

After the executable is deleted, a file called volta_debug.txt may remain on the computer, containing a record of the data and whether the AI analysis succeeded. It is recommended not to delete it straight away. It holds data that can be used to revoke hijacked tokens and change stolen passwords. The Antyweb author notes, however, that once VOLTA has run, the data is already in criminals' hands.

What this means for you

The sources describe a threat aimed mainly at the US and do not point to attacks in the UK. The mechanism, though, applies to any computer user with passwords saved in a browser, cloud accounts and online shopping. If you suspect an infection, it makes sense to change passwords from another, clean device and revoke active sessions. These steps follow from the description of how the program works, not from official advice in the source.