A new infostealer uses LLMs to pick its richest targets

Malware usually sprays and prays: steal everything, sort it later. VOLTA flips that. Researchers say the Windows info‑stealer taps large language models (LLMs) to score who’s worth robbing first—and it loots Outlook and Slack on the way.

The discovery, reported by The Hacker News, names the malware VOLTA‑AUTODOXER (aka VOLTA). It pulls passwords and cookies from Chromium‑based browsers, then digs into Outlook profiles and Slack workspaces to broaden the haul. The punchline: it queries LLMs like Anthropic’s Claude, Google’s Gemini, and Moonshot’s Kimi to rank victims by monetization potential.

What happened

Cybersecurity researchers uncovered VOLTA’s playbook on Windows: harvest from Chromium browsers, exfiltrate mail and chat artifacts, and ask an LLM to triage who’s lucrative. The Hacker News says the malware targets Chromium stores for passwords and session cookies, which cover popular browsers like Chrome, Edge, Brave, and Opera.

Beyond the browser, VOLTA reportedly scrapes data from Outlook profiles. On Windows, those profiles can reveal mailbox configuration and stored secrets, raising the risk of inbox access or downstream account recovery abuse if paired with stolen cookies.

The campaign also touches Slack workspaces, according to the report. Exposed workspace tokens or cached data can map teams, channels, and roles—handy for targeted social engineering and lateral movement once attackers decide who’s “high value.”

LLM usage is VOLTA’s novelty. Instead of humans sifting stolen files, the malware pings Claude, Gemini, and Kimi to evaluate victim data and sort targets by likely profit. That automation compresses the window between compromise and follow‑on actions like account takeover, payroll fraud, or vendor impersonation.

Ranking victims changes attacker workflow. If finance, executive assistants, or billing inbox owners bubble to the top, criminals can focus spoofed invoices and thread hijacks faster—tactics that repeatedly hit Microsoft 365 tenants in recent campaigns we covered, including token replay intrusions and AI‑cloned login phish that lift MFA.

VOLTA’s browser cookie theft matters because cookies can bypass passwords and multi‑factor prompts. We’ve seen how attackers scale this, from device‑code phishing to adversary‑in‑the‑middle kits. A stealer that also grabs Outlook and Slack context makes those tokens more dangerous by pinpointing who unlocks the biggest payout.

The background

Info‑stealers thrive because one infected machine often unlocks many doors: webmail, CRM, billing portals, and cloud consoles. We recently covered a separate stealer, “Aokigahara,” raiding developer keyrings and AI sessions, demonstrating how a single box can be a shortcut to code, cloud, and company context.

VOLTA adds triage. LLMs are inexpensive, fast, and fluent at summarizing messy data—exactly what criminals need to prioritize. Off‑the‑shelf models like Claude, Gemini, and Kimi can extract titles, departments, and financial hints from scraped inbox settings, Slack channel names, and browser autofill, then score potential ROI.

That scoring feeds classic email crime. Business email compromise (BEC) thrives on context: who approves payments, which vendors invoice monthly, what wording feels normal. Outlook profile artifacts plus Slack workspace clues let attackers stage convincing reply‑chain fraud and vendor impersonation without weeks of recon.

Email defenses are evolving too. Our reporting on phish baiting AI email assistants shows attackers already shaping how automated tools read messages. VOLTA’s twist moves AI to the back end—optimizing targets after theft rather than writing lures—yet the outcome is the same: more precise inbox abuse, sooner.

Policy guardrails matter as inbox providers get stricter. Recent shifts we covered, like Gmail’s tighter placement and authentication expectations, mean spoofers and lookalikes face more filters, but stolen sessions still walk around DMARC. That’s why we keep pushing DMARC plus identity hygiene, not either/or. If you’re new to the topic, the /category/security hub collects practical explainers and incident‑driven playbooks.

What people are saying

The Hacker News report attributes three specific LLMs—Claude, Gemini, and Kimi—as VOLTA’s triage engines. That detail signals criminals are comfortable calling mainstream AI APIs or self‑hosted analogs to automate victim scoring at volume.

Security teams view cookie theft as a persistent blind spot. Our previous coverage of Microsoft 365 token replay against 79 orgs documented how attackers slipped in without re‑prompting MFA, demonstrating why short‑lived sessions and continuous checks matter more than one‑time codes.

Defenders also flag collaboration pivots. Slack workspace data gives attackers a map of the org and a list of channels where finance and vendor ops live. That’s fertile ground for social engineering and for staging convincing messages that look like normal internal chatter.

Vendors are leaning into layered detection. Integrations that blend mailbox telemetry, browser signals, and identity analytics aim to spot anomalous access and message intent rather than single indicators—an approach we highlighted in platform tie‑ups and intent‑focused filtering earlier this year.

What happens next

Expect copycats. Once a stealer demonstrates that LLM‑driven triage shortens time‑to‑cash, other families will bolt on the same trick. It’s cheap, it scales, and it doesn’t require dazzling prompts—just enough structure to rank who’s likely to pay.

Prepare for faster inbox abuse after endpoint compromise. If an exec assistant’s machine gets popped, attackers won’t meander; they’ll go straight for wire approvals, vendor updates, and shared finance inboxes, armed with Outlook details and Slack context.

Tighten session hygiene now. Shorten browser session lifetimes for webmail and admin tools, force reauthentication for high‑risk actions, and watch for impossible travel on mail accounts. When cookies leak, they should expire before they’re monetized.

Harden identity and brand in parallel. Enforce SPF, DKIM, and DMARC at p=reject to block brand lookalikes while you lock down sessions. We’ve published step‑by‑steps to get there without trashing deliverability, including our practical plans in DMARC just got real: a 4‑week plan to harden delivery.

Watch collaboration pivots. Monitor Slack for new sessions from new locations, token reuse, and sudden channel browsing by rarely‑active users. Tie that to mail alerts for finance and vendor‑facing inboxes to catch cross‑app abuse quickly.