New VOLTA infostealer reportedly uses Claude, Gemini, and Kimi to rank victims by financial value

A new infostealer called VOLTA uses Claude, Gemini, and Kimi to assess and rank victims by financial value, according to The Hacker News. The report links the malware to several mainstream model services, rather than alleging that any one model was compromised.

The headline indicates that VOLTA does more than collect data in bulk: it also tries to determine which victims deserve priority. The available summary does not explain how the malware accesses the models, what prompts it uses, or how accurate its rankings are.

Infostealers typically target credentials, browser sessions, and payment data. Adding a financial-value ranking layer could help attackers focus follow-on fraud and limited resources on the victims they consider most profitable.

The broader signal is that large language models may be pulled deeper into the attack chain, from generating phishing text and translations to screening stolen data and setting priorities. The concern is less that a particular model was named than that an attacker can use general-purpose AI to prioritize targets.

Important technical questions remain unanswered. Without sample hashes, an attack timeline, details on model access, or victim numbers, outside researchers cannot verify VOLTA's real capabilities, and the named model providers should not be treated as having been breached.

Watch for a fuller technical write-up from security researchers, responses from the three model providers, and detection work aimed at model-assisted victim triage.