HighBreach
VOLTA Malware Steals Gmail and Discord Sessions, Then Uses AI to Build Detailed Victim Profiles
Cyber Security News·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗
What happened?
A new Windows infostealer called VOLTA does more than steal passwords. After it grabs Gmail, Discord and other logins, it asks an AI model to study the loot and write a report on how much the victim is worth. The idea is simple: steal everything, then let AI sort it out. The malware calls itself “VOLTA-AUTODOXER.” It deletes itself after running, which makes it harder to find. It is also a sign of where cybercrime is heading.
Key details
- The malware searches the victim's Gmail inbox for receipts to confirm their home address.
- VOLTA uses stolen session tokens to access Uber Eats, DoorDash, and Discord accounts directly.
- The malware tries multiple AI models in sequence if the default refuses the request.
Affected
- Windows systems running Chromium-based browsers, Firefox, Thunderbird, Outlook, Slack, Steam, Battle.net, Telegram, Roblox, and Discord.
Fixes and mitigations
- Block Chrome from launching with the --headless flag unless started by a known developer process.
- Revoke stolen tokens and reset passwords from a clean device.
What to look for
- SHA-256 hash 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 for a VOLTA sample.
- Sample filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe.
- PE timestamp of 2026-08-17 20:35 indicating compile time.
- First seen in the wild on 2026-10-11 12:46 UTC.
- AI endpoint URL https[:]//openrouter[.]ai/api/v1/chat/completions used for analysis.
- AI models used: anthropic/claude-opus-4.6, moonshotai/kimi-k2, google/gemini-2.5-flash.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.