Cybersecurity researchers have uncovered a sophisticated new malware, named VOLTA, that targets Windows systems to identify financially valuable targets by leveraging artificial intelligence (AI) to analyze compromised user data. According to findings shared by Cisco Talos, the software specifically aims to distinguish individuals who own cryptocurrency assets.
Crypto Wallet Vulnerabilities Under Scrutiny
Unlike traditional data-stealing malware, VOLTA does more than just collect passwords and session data. It evaluates stolen information to create detailed victim profiles, prioritizing assets that can be exploited for financial gain. This mechanism reduces the attackers’ need to manually sift through vast data sets.
Researchers identified one of the most serious threats as the unauthorized access to sensitive cryptocurrency wallet information. VOLTA is capable of extracting recovery seed phrases and includes features designed to breach wallet security. This poses a direct risk for users who store wallet data on their computers.
Cisco Talos highlights that VOLTA sends hijacked data to AI models to comprehensively assess the victim’s financial portfolio, strategically listing assets with high potential returns.
Expansive Data Harvesting Capabilities
VOLTA’s reach extends beyond cryptocurrency. Cisco Talos researcher Ryan Fetterman reports that it can collect stored browser passwords, payment card details, authentication tokens, email account data, and active sessions. Popular platforms such as Telegram, Discord, Steam, and Roblox are within its purview.
Additionally, the malware targets Outlook accounts, Slack workspaces, and other personal or corporate information on infected systems. It scrutinizes email accounts to mine order confirmations and receipts from services like Amazon, PayPal, Walmart, DoorDash, and Uber Eats, thus giving attackers insights into users’ addresses, jobs, and spending habits.
The targeting of sensitive information like crypto wallet seed phrases and session data underscores the need for users to closely monitor such activities. CryptoAppsy offers real-time alerts and news about specific coins, easing the task of tracking sudden movements and news flow post-security incidents.
Sequential AI Model Deployment
According to Cisco Talos, VOLTA transmits stolen data using OpenRouter to various AI models. Initial analyses employ Anthropic’s Claude Opus 4.6 model, and if not processed, Moonshot AI’s Kimi K2 model and Google’s Gemini 2.5 Flash model are sequentially tried.
Researchers noted that the malware checks model request refusals before switching to the next model. The AI tools are tasked with evaluating the victim’s financial standing, pinpointing valuable assets, and ranking them by their profit potential. Additionally, the software can appraise the target’s cybersecurity level.
Ryan Fetterman notes that VOLTA’s ability to collect a vast array of data—from browser-stored passwords and payment card information to active messaging platform sessions and email data—illustrates its extensive reach.
This structure demonstrates that attackers are not merely content with stealing data; they use AI to pre-emptively identify more profitable victims. It is crucial for users storing wallet information, recovery phrases, or financial records on their computers to adopt additional security measures.
