What happened
Cybersecurity researchers have identified a new Windows-based infostealer malware designated as VOLTA-AUTODOXER, or VOLTA. This malware utilises a large language model (LLM) to prioritise stolen data according to its potential monetary value. Once active, VOLTA is capable of harvesting passwords and cookies from Chromium-based web browsers, as well as extracting data from Outlook profiles and Slack workspaces. The malware employs advanced techniques, including AI components, to enhance its data collection and ranking capabilities.
Who is affected
Organisations running Microsoft Windows and utilising Chromium-based browsers are potentially affected. This includes environments where users access Outlook and Slack, as these are targeted by the malware. Due to the malware’s sophistication and its method of using AI to assess the value of stolen data, the threat presents a moderate level of risk. The lack of immediate exploitation indicators does not eliminate the possibility of targeted or widespread attacks exploiting similar techniques.
Recommended actions
- Restrict access to known malicious or compromised websites associated with cyber threats where possible to prevent initial infection vectors.
- Implement network monitoring to detect unusual outbound traffic patterns that may indicate data exfiltration from compromised hosts.
- Ensure that endpoint security solutions are maintained with updated signatures and capabilities to detect malicious activities attributable to infostealer malware.
- Apply best security practices related to the use of web browsers and email clients, including regular credential updates and the use of multi-factor authentication where available.
- Maintain a regular review of logs associated with web browser activity, email, and network traffic for potential signs of unauthorised data access or transfer.
