VOLTA malware uses Claude to rank stolen valuables before self-deleting

The mechanics of VOLTA

The VOLTA malware is a Windows infostealer designed to gather a wide array of sensitive personal information from a victim's computer. It targets browser data such as passwords, cookies, and saved payment cards, alongside email profiles from Outlook and Thunderbird. It also seeks out high-value items like Roblox accounts, Microsoft OAuth tokens, and cryptocurrency-wallet vaults.

Beyond simple data theft, the malware constructs a structured 'evidence bundle' from the stolen files. This dossier includes geolocation data, home addresses, employer information, and even inferred birth years. It even attempts to confirm physical locations by searching Gmail for receipts from retailers like Amazon, DoorDash, and Walmart.

Once the data is collected, the malware serializes it into a JSON format. It then sends this information to OpenRouter, a service that provides access to various large language models. The malware specifically asks the AI to rank the victim's valuables based on how much they could be cashed out for.

AI as a forensic analyst

To get the best results from the AI, the malware uses a specific system prompt. It instructs the model to act as a 'forensic intelligence analyst' and demands that the output be 'blunt, specific, accurate.' The goal is to receive a concise, citation-backed assessment of the victim's suitability as a target for a cyberattack.

The malware defaults to using Anthropic's Claude Opus 4.6 model. It uses a low temperature setting of 0.2, which suggests the attackers want predictable and consistent results rather than creative ones. If the chosen model refuses to perform the analysis, the malware is programmed to switch to Moonshot AI’s Kimi K2 or Google’s Gemini 2.5 Flash.

If no API key is provided by the attacker, the malware can still function by sending the dossier over Telegram. In this scenario, it skips the AI-generated analysis but still delivers the stolen data. This flexibility ensures the malware remains effective regardless of whether the attacker wants an automated valuation or just the raw data.

Infrastructure and evasion

The malware is designed to be sold to other criminals, featuring six swappable slots for custom configurations. These slots can include specific Telegram channels, API keys, and other settings. A customer provides these values, and the attacker creates a custom binary for them to use in their own operations.

To bypass security measures like Chrome's App-Bound Encryption, VOLTA launches Chrome in a 'headless' mode, which means it runs without a graphical interface. While certain application-control policies can block this specific path, the malware still retains its ability to steal other data and perform its AI-driven analysis. The malware also includes a self-deletion mechanism where the main executable may delete itself after the infection is complete.

As reported by Mezha.net, the malware exfiltrates the final analysis and the evidence bundle in a compressed archive. By using third-party services like OpenRouter and Telegram as the primary chokepoints, the attackers reduce the amount of infrastructure they need to own and manage themselves. This makes the operation harder for security teams to track back to a single source.

Impact and next steps

For the average user, the presence of VOLTA means that personal data is being processed by third-party AI models to determine its market value. This highlights a growing trend where malware uses AI to automate the 'filtering' of victims, identifying the most profitable targets with minimal human effort. It also shows that AI refusal mechanisms are being actively tested and bypassed by malware developers.

Security researchers suggest that this is only a narrow use of AI in malware. They warn that models could eventually be used in more complex stages of an attack, such as generating convincing phishing content or automating deeper system intrusions. As AI integration becomes standard, malware developers will likely focus on creating more robust ways to bypass AI safety filters.

Victims who suspect they have been targeted should immediately rotate all API keys and tokens and change their passwords. If a cryptocurrency wallet's seed phrase was found in plaintext, the funds should be moved to a new wallet using a fresh seed. Users should also look for a file named 'volta_debug.txt' on their systems, which may contain a log of what the malware successfully collected.