# New VOLTA Malware Uses Public AI Models to Rank Victims and Build Target Profiles

*Monday, November 2, 2026 at 6:16 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-02T06:16:51.419Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/22231.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Security researchers say a new infostealer dubbed VOLTA not only lifts passwords, cookies, and crypto wallet data but also queries public AI services like Claude, Gemini, and Kimi to prioritize victims and send auto‑generated dossiers to attackers over Telegram.

A newly reported malware strain is giving attackers automated help in deciding which victims to go after first.

Researchers have identified an infostealer called VOLTA that behaves like conventional credential‑stealing malware in its initial stages. Once it infects a device, it collects passwords, browser cookies, and data from cryptocurrency wallets.

What stands out is what happens after the data grab. According to the technical write‑up, VOLTA sends stolen information to public large‑language‑model services, specifically including Claude, Gemini, and Kimi, and uses their responses to rank victims by potential value to the attacker.

The malware also reads Gmail receipts to verify details about each target. Those receipts help confirm where a person shops, which services they use, and sometimes where they work.

Using that mix of stolen credentials and extracted email data, VOLTA has the AI models generate compact summaries, or dossiers, on each victim. Those dossiers are then forwarded to the attacker via Telegram, giving them an organized list of which accounts or individuals look most promising.

This design reduces the manual sorting that usually slows criminal operations built on mass data theft. By offloading triage work to public AI tools, even low‑skill operators can more quickly identify high‑value logins or wallets.

Security teams are now watching for signs that other malware families adopt similar AI‑aided triage. Responses from the operators of Claude, Gemini, and Kimi—such as new abuse‑detection systems or usage limits tailored to this pattern—will help show how AI providers intend to handle being drawn into this type of attack chain.