Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Infostealer Malware: Why a Password Reset Is Not Enough

Infostealer Malware: Why a Password Reset Is Not Enough

A new Windows infostealer malware called VOLTA copies everything useful from an infected PC, then asks an AI model to work out which of it is worth the most money. If one of your staff saves passwords in their browser, that haul can include your business logins. Changing the password afterwards is not enough.

What the VOLTA infostealer malware actually does

Cisco Talos published its analysis of the malware on 31 October 2026. Help Net Security reports that VOLTA grabs browser passwords, cookies and saved payment cards, Microsoft OAuth tokens, SSH and cloud provider keys, and screenshots. It then sends the data to an AI model, which ranks the victim’s assets by how much money they could bring in. The Hacker News adds that the output includes a section on the victim’s security posture and password hygiene. Talos says it looks like a product sold to buyers, not one group’s private tool. Talos does not report a victim count, an infection route or who operates it, so this is a capability warning, not a confirmed outbreak.

Why it matters if you run a small or mid-sized business

Most people think of stolen credentials as a list of passwords. VOLTA shows why that picture is out of date. The same run that takes a password also takes the session cookie and the Microsoft token, and those are what prove to a service that you are already signed in. An attacker holding them may not need your password at all, and may not be asked for your second factor either.

The mechanism is simple. A member of staff gets malware on a PC, from whatever route. The malware reads what the browser has stored. The attacker now has working access to email, cloud storage or admin portals, and the infected machine may show nothing odd.

The AI step changes the economics, not the entry point. Talos describes it as removing the analysis work from the criminal. A small firm’s stolen data used to sit in a pile of thousands of other logs. Now the pile can sort itself, and a smaller business with a finance login is easier to spot.

What would have helped? Passwords kept out of browsers, multi-factor authentication that is hard to bypass, short session lifetimes, and knowing quickly when your credentials turn up somewhere they should not.

What to do this week

  1. Ask your IT person to stop staff saving company passwords in browsers and move them to a managed password manager.
  2. Ask them to confirm that, after any suspected infection, they sign the user out of every session and revoke tokens, not just reset the password.
  3. Ask whether application control can limit which processes may launch Chrome in headless mode, which Talos says blocks VOLTA’s way of decrypting Chrome’s stored data.
  4. Check that every Microsoft 365 and cloud admin account uses multi-factor authentication, and review who still has admin rights.
  5. Find out whether anyone is watching for your company’s credentials appearing in stolen data, and who acts if they do.

How Wolfcore helps

Breachy is our breach exposure monitoring service. It looks for signs that your company’s credentials and data are already out there, so you hear about it before an attacker uses it. See Breachy to find out what it checks, or get in touch to talk it through.

Ruben Selby, Founder and Lead Security Consultant, Wolfcore

Sources