Cisco Talos has described VOLTA, a new Windows infostealer that, besides passwords, cookies, cards, wallet seed phrases and cloud keys, builds a profile of the person behind the computer, The Hacker News reports. It uses stolen Gmail access to confirm the home address from purchase receipts. The profile is sent through OpenRouter to language models, switching to another model when one refuses, so that the victim's assets are ranked by value. Data is exfiltrated over Telegram in three stages.

What it means: VOLTA shows how AI is changing the economics of data theft. Until now, criminals collected huge volumes of logs and struggled to tell which victims deserved more effort. With a model that reads the stolen data and produces a priority list, that choice is automated, leading to more targeted fraud, extortion and break-ins to corporate accounts. The malware also collects details about the employer, Slack workspaces and Microsoft account tokens, so an infected personal computer can become a gateway into the company. For Greek businesses the measures are familiar but more urgent: phishing-resistant authentication, short session lifetimes, token revocation when an infection is found, and a policy on using personal devices with company systems. Users should avoid storing seed phrases and passwords in plain files or in the browser. The report also raises a question for model providers and gateways such as OpenRouter, which need to detect this kind of use before it becomes routine.

Read the original on The Hacker News

Related service: Custom software

Related stories