New malware targets personal data

Researchers have identified a new infostealer malware named VOLTA-AUTODOXER, which is capable of accessing receipts from Uber Eats and other personal data belonging to its victims before passing the stolen information to an artificial intelligence model for analysis.

Malware steals various types of data

The malware is designed to steal a variety of information, including identifiers and bank card data stored in browsers, access to email accounts, sessions on platforms like Discord, Telegram, or Steam, Wi-Fi passwords, and cryptocurrency wallets. It can also reuse stolen sessions to access victims' online accounts and collect more information, such as checking Gmail for Amazon, PayPal, or Uber Eats order confirmations and browsing delivery histories of some services.

AI analysis helps identify targets

This information allows the malware to confirm a personal address and enrich the profile of its owner. The collected data is compiled into a file containing the presumed identity of the victim, their residence, their employer, and their digital resources. VOLTA can then submit this file to Claude, via OpenRouter, a service providing access to several AI models, and ask it to behave like an intelligence analyst, tasked with evaluating the victim's resources according to their financial potential.

Malware uses multiple AI models

It also asks the model to examine the victim's security habits, including the quality of their passwords, to identify weaknesses that could facilitate new attacks. The developers of the malware anticipated potential refusals from Claude. If the model refuses to respond or if the request fails, VOLTA can then request Kimi, then Gemini. However, the AI analysis is not essential to its operation: the malware can transmit the stolen information without going through this step.

Malware communicates through Telegram

The collected data and, if applicable, the AI analysis are sent to the attacker via Telegram. The program can then delete its own executable to minimize traces of its presence. Cisco Talos, the researchers who identified the malware, do not document any active infection campaign and do not specify how VOLTA could end up on a computer. Therefore, it is impossible to identify a particular trap to avoid.

Prevention and response strategies

For individuals, prevention relies on usual precautions against malware: verifying the source of downloaded programs, maintaining active antivirus protection, and keeping Windows and its applications up to date. The researchers have identified a way to counter one of the techniques used by VOLTA to bypass the encryption of Chrome's data. By limiting the programs authorized to launch the browser without displaying its interface, administrators can block this method of retrieving protected information. The measure mainly concerns computers managed in businesses and does not block its other capabilities for stealing data.

Post-infection actions needed

If the infection has already occurred, the disappearance of the program does not mean the accounts are out of danger. The hackers may retain stolen login sessions, even after a password change. Therefore, it is necessary to act from a clean device, renew the affected identifiers, and disconnect open sessions from the security settings of the various services. SSH keys and other potentially compromised authentication secrets should also be revoked or renewed. Finally, if the recovery phrase of a cryptocurrency wallet was stored unprotected on the computer, Cisco Talos recommends considering that wallet compromised and transferring the funds to a new one, created in a secure environment.