Cybercriminals have found another use for commercial AI models. Cisco Talos researchers say a Windows malware family called VOLTA-AUTODOXER, or VOLTA, steals data and then asks AI models to judge which victims are worth pursuing. The targets include people who hold crypto wallets on infected machines.
What VOLTA steals
Unlike older info stealers that mostly grab passwords, VOLTA builds a profile from the machine. It pulls saved browser passwords, payment card details, authentication tokens, email logins, and active sessions for services such as Telegram, Discord, Steam, and Roblox. It also looks at Outlook accounts and Slack workspaces.
The malware can scan Gmail for purchase confirmations and receipts from Amazon, PayPal, Walmart, DoorDash, and Uber Eats. That gives attackers clues about identity, address, job, and spending habits.
For crypto users, the bigger concern is wallet data. VOLTA tries to extract recovery seed phrases and includes features that can crack wallet vaults. If those credentials sit on a PC, the risk is direct.
AI models rank victims
The malware sends stolen data through OpenRouter, a service that routes requests to multiple AI models. It first tries Anthropic’s Claude Opus 4.6. If the model refuses or fails, VOLTA falls back to Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash. Cisco Talos says the code looks for refusal responses before switching models.
The AI is asked to evaluate a victim’s financial worth, identify valuable assets, rank them by profit potential, and even score the person’s cybersecurity posture.
Why this matters
This is not just automation for its own sake. It reduces the manual work of sorting through stolen files. A criminal can get a short list of high-value targets without reading every email or browser record.
I think the crypto angle is the part to watch. Seed phrases are hard to replace once exposed, and a wallet vault on a desktop is only as strong as the machine around it.
Cisco Talos researcher Ryan Fetterman detailed the malware in the new report. The findings suggest that AI refusal checks are already part of some criminal tooling, perhaps not as a moral barrier but as a routing problem.
Users can lower the risk by keeping seed phrases offline, avoiding saved wallet credentials on daily-use computers, and treating unexpected account sessions as a possible sign of compromise.
The post Hackers Use Claude, Gemini, Kimi to Score Crypto Targets appeared first on TheCryptoUpdates .
