Source: The Hacker News
Cybersecurity researchers at Cisco Talos have discovered a new Windows infostealer called VOLTA-AUTODOXER, or VOLTA, that uses a large language model to rank a victim’s stolen data by its monetization value.
What VOLTA steals
Like other stealer families, VOLTA harvests passwords and cookies from Chromium-based browsers, data from Outlook profiles and Slack workspaces, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles and screenshots.
AI turns stolen data into a target profile
The difference is what happens next. VOLTA builds a structured evidence bundle about the person behind the machine, containing geolocation and home address, employer and employer domain, inferred birth year, card details, Slack workspaces, document authorship metadata, iPhone backup indicators and a live Roblox account valuation. A large language model then ranks the victim’s financial value, which lets the attacker focus effort on the most profitable targets first.
For businesses, the worrying part is the haul of work credentials: Microsoft OAuth tokens, SSH keys and cloud-provider keys can open the door to corporate email, source code repositories and cloud consoles long after the initial infection. A single infected employee laptop can become a staged intrusion into production systems.
How to respond
Endpoint detection, browser isolation and strict token lifetimes reduce the blast radius, but the strongest defenses are least-privilege access, phishing-resistant multi-factor authentication, and rapid rotation of any cloud keys that touched an unmanaged device. Treat every unexplained OAuth token grant as an incident, not a curiosity.
Need help auditing your infrastructure or preparing for EU cloud rules? Contact the team at Excello Digital for professional advice and hands-on support.