Cybercriminals Exploit AI Models to Target Crypto Assets, Says Cisco Talos

Introduction

Cybercriminals have reportedly turned to sophisticated artificial intelligence platforms—namely Anthropic's Claude, Google's Gemini, and Moonshot AI's Kimi—in order to assess the financial vulnerabilities of their targets, particularly those involved with cryptocurrency.

New Malware: VOLTA-AUTODOXER

A recent investigation by cybersecurity experts at Cisco Talos unveils a concerning new form of Windows malware known as VOLTA-AUTODOXER, or simply VOLTA, engineered to pilfer sensitive information while leveraging AI technologies to pinpoint high-value victims among the hacked individuals.

Advanced Capabilities of VOLTA

Unlike conventional malware that primarily focuses on acquiring passwords or sensitive credentials, VOLTA possesses the advanced ability to evaluate the data it pilfers to construct detailed profiles of potential victims. This profiling enables the malware to identify exploitable assets for profit. Particularly alarming is its capacity to extract crucial details from cryptocurrency wallets, such as recovery seed phrases, potentially granting cybercriminals full access to a victim's digital assets.

Furthermore, VOLTA is designed with functionality that can decrypt cryptocurrency wallet vaults, escalating risks for users who keep their crypto credentials on personal computers.

Broader Implications

However, the operational scope of VOLTA extends beyond cryptocurrency theft. According to cybersecurity researcher Ryan Fetterman of Cisco Talos, this malware can also harvest:

• Saved passwords from web browsers
• Credit card data
• Authentication tokens
• Email login details
• Active sessions across various popular applications, including Telegram, Discord, Steam, and Roblox

The malware is equipped to extract emails from Outlook accounts and Slack workspaces, alongside gathering a myriad of personal and professional data from infected systems.

Intrusive Data Collection

Taking its intrusive measures a step further, VOLTA scans victims’ email accounts to unearth additional personal insights, including purchase confirmations and receipts from major retailers such as Amazon, PayPal, and Walmart. This enables cybercriminals to compile more comprehensive profiles that reveal a victim’s identity, home address, employment, and shopping behaviors.

Data Analysis and Targeting

The malware employs the OpenRouter service to dispatch the stolen information to AI models for analysis. Initially, it attempts to process the gathered data using Anthropic's Claude Opus 4.6. Should this approach encounter obstacles, VOLTA has built-in protocols to engage Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash, targeting alternative AI models depending on the responses received.

By leveraging these AI systems, VOLTA not only analyzes the hijacked data but also generates thorough evaluations of a victim's financial worth, identifying and categorizing lucrative assets while also assessing their cybersecurity levels. In essence, VOLTA enables cybercriminals to proactively identify potential prey without laboriously sifting through the stolen data themselves.