VOLTA Malware Deploys AI Models to Target Crypto Wallets
Key Summary
Cisco Talos researchers uncovered a new Windows malware variant called VOLTA that utilizes popular AI models like Claude, Gemini, and Kimi to automatically sift through stolen financial data, prioritize high-net-worth crypto targets, and extract recovery seed phrases.
Key Bullets
- Malware variants known as VOLTA use OpenRouter to automatically send stolen local files and browser credentials directly to large language models.
- Operators leverage Anthropic Claude Opus 4.6, Moonshot AI Kimi K2, and Google Gemini 2.5 Flash to evaluate the net worth of victims.
- Cisco Talos researchers confirmed the malware specifically targets crypto wallet vaults and recovery seed phrases stored locally on infected Windows machines.
- Automated scripts evaluate purchase receipts and email accounts to rank individuals based on their potential financial payout for hackers.
Malware Deploys AI for Asset Scanning
Windows malware dubbed VOLTA surfaced Tuesday in a technical threat report published by Cisco Talos researchers detailing automated credential harvesting. Unlike traditional password stealers, the software uses external large language models to analyze stolen user files and rank victims by financial worth. Attackers routed stolen data through the OpenRouter service to query commercial AI models without manual intervention.
The software targets local drives to extract sensitive browser data, saved payment cards, and authentication tokens across popular messaging applications. Operators bypass manual data review entirely by letting automated scripts process the stolen intelligence.
AI Models Rank Lucrative Crypto Targets
Public threat intelligence reports confirm VOLTA attempts to process harvested files using Anthropic Claude Opus 4.6 as its primary intelligence engine. If the model rejects the payload, hardcoded fallback routines route the data to Moonshot AI Kimi K2 and Google Gemini 2.5 Flash. The malware specifically monitors for safety refusal responses before cycling through alternative providers.
Each query instructs the designated AI model to evaluate the financial holdings of the compromised user and generate a priority score for attackers. Crypto wallet vaults and recovery seed phrases represent primary objectives for the malware architecture.
Seed Phrases and Vaults Under Attack
Cryptocurrency holders storing private keys and seed phrases on local Windows systems face severe exposure from the active threat campaign. Cisco Talos telemetry indicates the malware systematically hunts for wallet files, browser extensions, and desktop configurations holding digital assets. Stolen credentials are bundled with parsed email receipts from retail platforms to build complete financial profiles.
The automated targeting pipeline reduces the operational overhead required for cybercriminals to identify wealthy blockchain participants. Traders maintaining hot wallets on unencrypted desktop environments absorb the highest risk exposure from the active malware deployment.
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.