VOLTA Malware Uses AI to Rank Victims by Asset Value

The new Windows malware, dubbed VOLTA, utilizes AI to analyze stolen user data and rank potential targets based on asset value. It gathers information from services like Gmail, Amazon, Uber Eats, and PayPal, then compiles a report in JSON format.

The malware sends collected data to OpenRouter to generate an assessment of the victim's security posture. By default, it uses Anthropic’s Claude Opus 4.6, but it can automatically switch to Moonshot AI’s Kimi K2 or Google’s Gemini 2.5 Flash if a model refuses the request.

VOLTA is designed as a resalable product with six customizable slots for API keys and Telegram channels. It bypasses Chrome’s App-Bound Encryption by launching the browser in headless mode, allowing it to steal session tokens.

After completing its tasks, the malware may delete its main executable, leaving behind a log file named volta_debug.txt. Experts recommend that victims rotate all API keys, change passwords, and move funds from any compromised wallets immediately.