Return to Threats

New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value

thehackernews.com 2026-11-02 malicious AI use Critical
Run AI Security Assessment Talk to AI CISO

Executive Summary

A Windows infostealer named VOLTA uses Claude, Gemini, and Kimi AI to prioritize stolen data according to its financial value. Security teams, especially those protecting browser credentials, Outlook profiles, and Slack workspaces, should care.

What Happened

Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces;

Affected Products

  • Claude
  • Gemini
  • Kimi AI
  • Chromium-based web browsers
  • Outlook
  • Slack

Vulnerability / Attack Technique

LLM-assisted infostealing and victim-data prioritization

Technical Mechanism

VOLTA harvests passwords and cookies from Chromium-based web browsers and collects data from Outlook profiles and Slack workspaces. It uses a large language model to rank the stolen data by its monetization value.

AI Security Category

AI-assisted attack

Part of the AI-Assisted Attacks topic.

Relevant Frameworks

MITRE ATLAS: Credential AccessMITRE ATLAS: CollectionMITRE ATLAS: ExfiltrationMITRE ATLAS: Impact

RealGround Analysis

Attackers are applying LLMs to automate prioritization of data stolen from non-AI targets, increasing the efficiency of credential and SaaS-account compromise. Teams running AI agents or LLM applications should assume that exposed credentials, browser sessions, and workspace data may be rapidly triaged and monetized by adversaries.

Recommended Controls

  • Enforce phishing-resistant multifactor authentication for Outlook, Slack, and other critical services.
  • Use endpoint protection to detect infostealers and block unauthorized access to browser credential and cookie stores.
  • Rotate exposed passwords, revoke active sessions, and invalidate compromised browser cookies after suspected infection.
  • Apply least privilege and conditional access controls to SaaS workspaces and administrative accounts.
  • Monitor outbound connections and anomalous access to browser, Outlook, and Slack data stores.

Related RealGround Service

AI CISO Advisory · or start with the free AI Agent Security Scanner.

Sources

thehackernews.com: https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html

Summary and analysis written by RealGround from the source above; last updated 2026-11-02.

Talk to AI CISO