VOLTA infostealer malware uses Claude AI to rank stolen victim data

Cybersecurity researchers at Cisco Talos have identified a new infostealer malware strain that uses artificial intelligence to evaluate stolen victim data, Tom's Hardware reported. The malware, known as VOLTA or Volta-Autodoxer, feeds compromised user files directly to an external artificial intelligence model to rank victims by financial value. [1][2]

According to Tom's Hardware, the VOLTA malware transmits stolen data to Claude Opus 4.6 to perform a target assessment on each victim. The system uses automated queries to evaluate stolen records and rank victims based on their monetization potential. [1]

As FTMQ SI reported earlier, the malware gathers a wide range of sensitive personal records from compromised systems. The exfiltrated data includes user login credentials, credit card numbers, Discord sessions, Gmail receipts, and food-delivery orders from services such as UberEats. [1][2]

Tom's Hardware reported that after the malware sends the stolen files to the model and completes its assessment, it deletes itself from the infected device to avoid detection. [1]