Cisco Talos found a Windows infostealer, VOLTA, that doesn't just rob you. After it takes your passwords, cards, crypto wallets and session tokens, it ships the haul to an AI model and asks it to appraise you — rank victims by how much they're worth, richest wound first.
the file that ranks you by value
your life, bundled and priced
Cisco Talos — first seen Oct 11
VOLTA is a self-deleting Windows infostealer, and the theft itself is ordinary. The twist is what comes after. It assembles a structured profile of you — where you are, who you work for, your cards, an estimated age — and hands it to an AI with a single instruction: appraise this person. Back comes a tiered valuation and a read on how easily you could be hit. It even logs in as you with your stolen tokens to fatten the file — your receipts, your deliveries, your wallets — before shipping the whole dossier off.
Here's the line being crossed. Attackers used to steal everything and sort it later — by hand, slowly, one analyst at a time. That human triage was the expensive part, the bottleneck. Now it's automated and instant. Breaches already scale; now the judgement scales with them, so the most valuable victims get worked first, at machine speed. And every bit of it rests on one assumption: that your life is sitting somewhere an attacker can reach — tokens on a server, histories in a cloud, a trove waiting to be read. Take that assumption away and the appraisal has nothing to appraise.
Malware that steals your data, then sends it to an AI told to rank you by monetization value — enriching the file with your own stolen logins.
The expensive, human part of an attack — deciding who's worth the effort — just got cheap and instant. Cheap things spread.
Structural, not hopeful: don't leave the material where it can be taken. Data that never leaves your device can't be exfiltrated, enriched, or priced.
Credit to Cisco Talos for the research. They call it “effort displacement” — the malware didn't get smarter, it just hired an analyst. That's the uncomfortable part: this isn't exotic or expensive, which is exactly why it will spread. The defense can't be “hope you're not worth appraising.” It has to be structural — keep the material out of reach in the first place.
Aura keeps your life on the device in your room.
The wake word, the speech, the model, your context — all on a neural core in the device itself. No cloud account, no session tokens sitting on a server to be stolen and replayed, no central store to exfiltrate, enrich, and price. On-device doesn't make you invisible — it removes the exact thing VOLTA feeds on: the trove. For the people whose job is protecting others, Farsight runs the same intelligence on-prem.
Know someone who should see this? Send it to them.