How Malware Authors Are Using AI to Turn Stolen Data into Quick Cash
Cybersecurity analysts have uncovered a new type of Windows infostealer that is using artificial intelligence to get more bang for its buck. Instead of simply grabbing files and credentials and leaving, this malware—dubbed VOLTA—uses a large language model to analyze the victim’s information and rank it by how much money it can generate.
The malware is built to sweep a compromised computer clean of sensitive data. It targets web browsers, extracting passwords, cookies, and session tokens from Chromium-based platforms. It also vacuums up details from email clients, messaging apps like Slack, and even pulls payment card information, cryptocurrency wallet seed phrases, and Wi-Fi network passwords. Beyond credentials, it steals session tokens for platforms like Discord, Telegram, Steam, and Roblox, and captures screenshots of the desktop.
What makes VOLTA particularly dangerous is its ability to build a detailed profile of the victim. The software gathers clues about the person behind the machine, including their home address, employer, estimated birth year, and the value of their online gaming accounts. To verify the victim’s home address, VOLTA uses the compromised email account to search for purchase receipts from retailers, food delivery apps, and payment services like Amazon, Walmart, Uber Eats, and PayPal.
Once the data is collected, it is packaged and sent to an AI system for analysis. The malware uses a routing service that queries multiple AI models. It tries one primary model first, but if that model refuses to process the request, it automatically switches to a backup model, and then a tertiary one if needed. The AI is given strict instructions to act as an analyst, drafting a report based solely on the stolen data. The report highlights the victim’s most valuable assets, grading them as low, medium, or high value, and also assesses the victim’s overall security habits and password hygiene.
The stolen data and the AI-generated report are then sent to the attacker over the messaging app Telegram in three distinct stages. The first batch is sent immediately after the initial data theft, containing browser passwords and crypto wallets. The second batch arrives after the AI analysis is complete, and the third batch is sent after the malware searches the victim’s email for receipts to add further context. The malware is also built using a modular template with empty slots for configuration, suggesting the creator may be selling a tool kit to other criminals, allowing them to customize the malware for their own operations.
This trend of integrating AI into malware is rapidly growing. Another emerging threat, known as NIK C2, goes a step further by stealing the victim’s own AI access credentials. If a compromised computer has an OpenAI key saved in its environment variables, NIK C2 will quietly use it to run its own data analysis. This trick, known as LLMjacking, lets the attacker hide their own identity while forcing the victim to pay for the computing power used during the attack.
Together, these developments mark a significant shift in cybercrime. By offloading the heavy lifting of sorting through stolen data to AI, attackers can quickly identify the most profitable targets and act on them faster than ever before.
Frequently Asked Questions (FAQ)
What kind of data does VOLTA steal?
VOLTA is an infostealer that targets a wide range of data, including web browser passwords, cookies, payment card details, cryptocurrency wallet phrases, and session tokens for apps like Discord, Telegram, Steam, and Roblox. It also grabs Wi-Fi passwords and desktop screenshots.
How does the malware verify the victim’s home address?
To ensure the stolen location data is accurate, VOLTA searches the victim’s active email inbox for receipts from online retailers and delivery services like Amazon, Walmart, DoorDash, and PayPal.
What is LLMjacking?
LLMjacking is a technique where attackers find and exploit an AI API key stored on a compromised computer. Instead of paying for their own AI processing power, they use the victim’s account to run malicious analysis, making the victim foot the bill while covering the attacker’s tracks.
How is the stolen data sent to the attacker?
All stolen information and AI-generated reports are exfiltrated through the messaging app Telegram, sent in batches at different points during the attack.
What is the purpose of the AI report generated by the malware?
The AI report acts as a triage tool, turning a messy log of stolen files into a clear, prioritized list of the victim’s most valuable and monetizable assets, ranked from low to high value.
Conclusion
The integration of artificial intelligence into malware like VOLTA and NIK C2 represents a major leap in cybercrime efficiency. By using AI to quickly sort through stolen data and identify the most profitable targets, attackers can maximize their returns while minimizing their effort. As these AI-powered tools become more accessible, the barrier to entry for cybercriminals drops, making it more important than ever for individuals and organizations to maintain strong security practices, such as using unique passwords and enabling multi-factor authentication.
Thank you for reading
