Executive Summary
VOLTA (also known as VOLTA-AUTODOXER) represents a significant shift in cybercrime tradecraft by integrating Large Language Models (LLMs) to perform automated target assessment. Unlike traditional stealers that rely on manual triage of harvested logs, VOLTA generates a structured evidence bundle including personal identity data, financial snapshots, and account valuations, which it then passes to an LLM via OpenRouter. This AI layer acts as a virtual intelligence analyst, ranking victims by their monetization potential and assessing their operational security posture.
The malware's technical sophistication is evident in its resilient multi-model architecture. It employs a fallback chain (Claude to Kimi to Gemini) to bypass model refusals and guardrails, ensuring consistent output. VOLTA's capabilities extend beyond basic credential theft to include live session enrichment, where it uses stolen tokens to query Gmail for receipts, UberEats for order history, and Roblox for inventory valuation, all performed from the victim's local network to evade detection.
The business impact of VOLTA lies in its ability to lower the operational threshold for low-sophistication attackers while increasing the scale of high-value targeting. By displacing human analytical effort with AI, the operators can efficiently process massive volumes of stolen data. Its reliance on third-party infrastructure and a builder-based distribution model suggests a growing commodity market for AI-augmented malware.