VOLTA uses AI to rank data after stealing it

Cisco Talos analyzed VOLTA, Windows malware that can send an assembled victim profile to language models for assessment. Its optional AI stage ranks valuable accounts and comments on security habits after credentials and sessions have already been collected. The documented workflow shows attackers using models to reduce the human effort of sorting stolen information.

Cisco Talos · Ryan Fetterman · Oct 31, 2026

Why it matters

The damage from stolen sessions can extend beyond account access into a combined profile of a person’s assets and habits.

More context

Talos describes local collection, enrichment using stolen sessions, a model request from the victim’s machine, and exfiltration of the resulting report. Its analysis distinguishes the theft mechanisms from the later assessment step and describes fallback models when requests fail or are refused.

Keep in mind

The report analyzes malware capabilities and configuration. It does not establish the accuracy of its rankings or that the optional AI stage succeeds in every infection.

Original read