Hackers Use Claude, Gemini and Kimi to Identify Valuable Crypto Targets

Cybersecurity researchers at Cisco Talos have identified a new Windows malware, VOLTA-AUTODOXER (VOLTA), that represents a significant advancement in cybercriminal tactics. Unlike traditional information-stealing malware, VOLTA not only steals credentials but also uses AI models to analyze stolen data and identify potentially lucrative targets among compromised users.

One of VOLTA's most dangerous features is its ability to extract sensitive crypto wallet information, including recovery seed phrases, which could give attackers access to digital assets. The malware can also crack cryptocurrency wallet vaults, posing a substantial risk for people storing their crypto credentials on their computers.

Beyond Crypto Theft

VOLTA's capabilities extend beyond cryptocurrency theft. It can grab saved browser passwords, payment card information, authentication tokens, and credentials from email accounts, Telegram, Discord, Steam, Roblox, Outlook, and Slack workspaces. The malware further analyzes victims' email accounts to gather purchase confirmations and receipts from services like Amazon, PayPal, Walmart, DoorDash, and Uber Eats.

AI-Powered Target Selection

The malware sends stolen data to AI models via the OpenRouter service, initially attempting to process it using Anthropic's Claude Opus 4.6. If that fails, it tries Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash. VOLTA specifically looks for refusal responses before attempting different AI models.

The AI models analyze the collected data to provide a comprehensive evaluation of a victim's financial worth, identify valuable assets, rank them based on potential profitability, and even score the victim's cybersecurity. This approach allows hackers to prioritize targets without manually sifting through stolen data, significantly increasing the efficiency and effectiveness of their attacks.