Cisco Talos found a Windows data thief that asks AI chatbots to rank victims by how much money they could bring in. Here is what it takes and what to do.
Security researchers at Cisco Talos have found a new Windows data-stealing program called VOLTA that does more than grab passwords. It sends what it learns about a victim to an AI chatbot, which ranks how much money that person could be worth to criminals.
VOLTA is an infostealer, a program that quietly collects saved passwords and cookies (small files that keep you logged in) from browsers built on Chromium. What is new is the next step. It builds a profile of the person behind the PC and hands it to an AI to sort.
To confirm a home address, VOLTA uses stolen login access to search the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal.
The profile goes to an AI service through OpenRouter, a gateway that connects to many models. It tries Anthropic's Claude Opus 4.6 first. If a model refuses, VOLTA moves on to Moonshot AI's Kimi K2 and then Google's Gemini 2.5 Flash. The AI is told to act as an analyst. It lists the victim's valuables as low, medium or high value and grades their password habits. The results are sent out over Telegram.
Talos says the AI layer is about saving criminals effort, not speed. VOLTA may be sold to others, which would let even a beginner receive ranked target reports. Researchers do not yet know whether it is sold or kept private.
Talos also described NIK C2, a Windows remote access tool that gives attackers control of a PC. If the attacker supplies no OpenAI key, it looks through the computer's settings for one and uses it. The victim pays for the AI work, and the requests are harder to trace back to the attacker.
The described targets are Windows PCs. People with saved browser passwords, Gmail, Slack, Roblox or OpenAI accounts are most exposed, along with businesses whose staff use those tools. The material does not say how VOLTA reaches a computer or how many people it has hit, so no group can assume it is safe.
The alert box above lists the steps. The main idea is to make stolen logins harder to use, keep AI keys out of your computer's settings, and clean up from a trusted device if you suspect an infection.
Security firm Zscaler says attackers increasingly use AI to search a hacked system for the most valuable or sensitive data. Ransomware groups, which lock files and demand payment, could use it to pick what hurts a victim most. Expect more tools that sort stolen data automatically.
Turn on two-step login for your key accounts and keep AI keys off your PC, because stolen data is now sorted by value and used faster.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone number
