Cisco Talos researchers have revealed VOLTA, a Windows information stealer employing artificial intelligence to assess victims after gathering passwords, session data, and cryptocurrency wallets This article explores information volta autodoxer. . The malware, known as "VOLTA-AUTODOXER," converts stolen information into ranked profiles, aiding criminals in identifying targets and valuable assets.
The AI component is optional, with the underlying stealer capable of collecting sensitive data without an API key.
VOLTA AI Compromises Victims VOLTA collects browser passwords, cookies, saved payment cards, cryptocurrency seed phrases, Microsoft OAuth tokens, SSH keys, cloud configuration files, and screenshots. It searches Gmail for shopping and payment receipts to establish home addresses, retrieves Uber Eats and DoorDash order histories, and gathers additional Discord profile details. This information is compiled into Identity_Report.txt, containing details such as the user's employer, location, inferred birth year, and payment card information.
The VOLTA-AUTODOXER workflow, sourced from Talos Intelligence, includes "WHAT THEY’RE WORTH," ranking assets by potential financial value, and "THEIR OPSEC," assessing security practices and password hygiene. Talos discovered six configuration slots during compilation, indicating a builder service that produces customized binaries for customers. Defenders should restrict processes that launch Chrome with the "--headless" flag, a behavior associated with VOLTA's App-Bound Encryption bypass path.
Utilize ANY.RUN for SOC teams to enhance threat investigation efficiency and reduce manual workload.
