VOLTA MALWARE USES AI TO RANK ITS VICTIMS — AND PICK THE RICHEST TARGETS

Cisco Talos reported on October 31 that the VOLTA infostealer can send a structured bundle of stolen information to an AI model to assess a victim's assets and security posture, according to an AI news briefing on November 1.

Researchers found a fallback chain involving Claude Opus 4.6, Kimi K2 and Gemini 2.5 Flash — meaning that if one model is unavailable, the malware simply tries the next.

The point of the AI step is triage: rather than dumping everything it steals, VOLTA uses the model to rank victims by how valuable and how vulnerable they are, so human operators can focus on the richest targets first.

It is the same shift visible in the Chainalysis breach disclosed the same day: AI moving from a chatbot that answers questions into an agent that acts on stolen access.

For defenders, the implication is uncomfortable — the malware is not just stealing data, but using the same frontier models companies deploy for legitimate work to decide who to hit hardest.