Your Crypto Wallet Could Be a Target: AI-Powered Malware Is on the Rise

• VOLTA malware uses AI to rank victims based on their stolen financial information and assets.
• It can steal crypto wallet recovery phrases, passwords, login tokens, and personal data.
• Crypto users should keep seed phrases offline, avoid suspicious downloads, and secure their wallets.

Hackers are now using artificial intelligence (AI) to find their most valuable victims. A newly discovered Windows malware called VOLTA-AUTODOXER shows how criminals can use AI to analyze stolen information and identify people with valuable financial assets and weak security habits.

According to research published by Cisco Talos on October 31, 2026, the malware steals sensitive information from infected computers and sends it to AI models. The AI then helps hackers rank victims based on how much money they could potentially steal from them.

Notably, VOLTA can steal wallet recovery phrases, saved passwords, login details, and other information that give criminals access to their digital assets.

How VOLTA Uses AI to Find Valuable Victims

Researchers discovered that VOLTA collects different types of personal information from infected Windows computers and saves them in a file called Identity_Report.txt.

The stolen information includes:

• Saved browser passwords and login cookies.
• Bank card details and crypto wallet recovery phrases.
• Microsoft login tokens.
• Active accounts on platforms such as Discord, Telegram, Steam, and Roblox.

The malware also checks victims’ Gmail accounts for receipts and payment records from Amazon, PayPal, Walmart, Uber Eats, and DoorDash. It also collects screenshots, location details, employer information, and details from personal documents. This helps hackers build a clearer picture of each victim’s financial situation.

How AI Helps Hackers Choose Their Targets

After collecting the information, VOLTA sends it to AI models through a service called OpenRouter, which connects applications to different AI providers. 

The malware is configured to try Anthropic’s Claude Opus 4.6 first. If that fails, it switches to Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash. The AI is instructed to act like an intelligence analyst and examine the stolen information.

It produces two assessments:

• “What They’re Worth”: Ranks victims based on the value of their financial assets.
• “Their OPSEC”: Examines victims’ security habits, including password strength and other security weaknesses.

This means hackers no longer have to manually examine every piece of stolen information. AI does much of the analysis for them, helping criminals quickly identify victims who could offer the biggest financial rewards.

Why This Is Dangerous for Crypto Holders

This discovery is especially worrying for crypto users because anyone who gets access to a wallet’s recovery phrase or seed phrase is able to take control of its funds.

Cryptocurrency transactions are mostly not reversible. In other words, once hackers steal and transfer someone’s crypto, getting it back can be extremely difficult.

VOLTA makes this threat worse by using AI to identify victims with valuable assets and weak security. Instead of simply stealing information, it analyzes the data to help criminals decide who is worth targeting.

For example, someone whose computer contains crypto wallet details, exchange login information, and weak passwords could be marked as a valuable target.

Cisco Talos says VOLTA is a commercial malware product that criminals can buy and customize. This means even hackers with limited technical skills could use it to analyze stolen information and find valuable victims.

Related: North Korean Hackers Stole $7.4B in Crypto in 2026: Here’s How They Did It

How Crypto Users Can Protect Their Wallets

VOLTA shows why crypto users need more than just passwords to protect their funds.

Here are some important safety measures:

• Do not download cracked software, pirated apps, or programs from untrusted websites. They may contain malware that steals personal information.
• Never save your wallet recovery phrase in emails, screenshots, cloud storage, browser password managers, or ordinary files on your computer.
• These help keep private keys away from internet-connected devices. However, never share your recovery phrase or approve suspicious transactions.
• Protect exchange accounts with authenticator apps or hardware security keys where available.
• If you suspect your computer has malware, stop using it for sensitive activities. Use a clean device to change your passwords, sign out of active sessions, and revoke stolen login tokens.
• If your wallet recovery phrase may have been stolen, create a new wallet with a new recovery phrase on a secure device and move your funds.

VOLTA shows how AI is making cybercrime more dangerous by helping hackers analyze stolen information and identify the most valuable victims. For cryptocurrency users, protecting wallet recovery phrases, passwords, login sessions, and personal information is more important than ever.