Cisco Talos: The VOLTA infostealer has AI models rank the data it steals by what it’s worth

Steal first, appraise later

On Oct. 31, Cisco Talos researcher Ryan Fetterman published an analysis of a Windows infostealer that calls itself “VOLTA-AUTODOXER.” The malware, which surfaced through Talos’ CAIRN research effort, deletes itself once it is done. The analyzed sample is a 64-bit Windows executable with a compile timestamp of Aug. 17, 2026; it was first seen on Oct. 11, 2026.

What it collects goes beyond a typical stealer’s haul: passwords, cookies and saved cards from Chromium-based browsers; Firefox, Thunderbird and Outlook profiles; Slack workspaces; Discord, Telegram, Steam, Battle.net and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; every saved Wi-Fi password on the machine; and screenshots. It does not just copy cryptocurrency wallets but also runs an embedded cracker against their vaults.

According to Talos, what sets VOLTA apart from commodity stealers is the stage after collection. The malware uses stolen sessions to enrich its data: it searches the victim’s Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls Uber Eats and DoorDash order history, reuses the stolen Discord token to enrich the victim’s profile, and values the Roblox inventory through a live lookup on Rolimons. Talos notes that a victim’s Uber Eats history has now become a potential liability.

The model chain and the “forensic analyst” prompt

The collected information is assembled in a file called “Identity_Report.txt,” serialized to JSON and posted to OpenRouter’s chat endpoint along with a system prompt. According to the configuration Talos found in the binary, the default model is anthropic/claude-opus-4.6, with a temperature of 0.2. The request is hand-assembled JSON, with no SDK. The malware checks replies for phrases like “I can’t” or “I’m not able” and, if it finds them, falls back to moonshotai/kimi-k2 and then google/gemini-2.5-flash. Talos says this design suggests the operator expects refusals, with the fallback pivoting to “smaller, and more permissive models.” If no API key is present, the AI stage is skipped entirely. Talos’ write-up does not say whether Claude actually refused these requests.

The system prompt casts the model as “a forensic intelligence analyst drafting a target assessment from a structured evidence bundle.” Required sections include “WHAT THEY’RE WORTH,” which ranks crypto, Roblox account values, cards and accounts by monetization with a low, medium or high tier, and “THEIR OPSEC,” which assesses the victim’s security posture, password hygiene and use of multifactor authentication. The prompt tells the model to “Go deep, not wide” and to “Be blunt, specific, accurate.” According to Talos, the model is not being asked to find data but to make connections across sparse information, such as linking a victim’s name, address or university to patterns in their passwords.

The model’s reply comes back as “AI_Analysis.txt,” and both files are exfiltrated together in “volta_dox.zip” over Telegram. Talos says exfiltration can happen in three stages: “volta_log.zip” after the theft, “volta_dox.zip” after the AI call, and “volta_doxnet.zip” if network enrichment turns up anything. The model call runs from the victim’s own machine and network connection. According to Talos, there is no attacker-owned infrastructure; every observed endpoint is controlled by a third party.

Possibly a tool for sale

Talos found that VOLTA uses a template with six swappable slots for its Telegram channel, API keys and settings. The company says this points to a builder model rather than a tool written for personal use: the author sells access, the customer supplies their own values, and a custom binary is compiled for each order. That is Talos’ inference; it reported no sales listing, price or victim count. The values in the slots are encrypted, but the key is a SHA-256 hash of two constants in the same binary, so anyone who reverses the file can recover them. If VOLTA is indeed sold, Talos says, the AI dossier becomes a feature that delivers ranked target assessments to the Telegram inbox of a customer at any skill level.

Talos concludes that VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work. It writes that building fallback chains against refusals (“refusal resilience”) may become a standard design requirement for malware. Startup Fortune reported that Fetterman told Wired the sample looks like “a working prototype”; that wording does not appear in Talos’ own post. There has been no statement on the matter from Anthropic, Moonshot, Google or OpenRouter.

On the defensive side, Talos says much of VOLTA’s token theft relies on bypassing Chrome’s App-Bound Encryption, and that an application control policy restricting which processes may launch Chrome with “–headless” would block that path entirely. After a compromise, it recommends preserving the volta_debug.txt file in the APPDATA folder, which logs what was collected and whether the LLM call succeeded, revoking tokens and changing passwords. Wallets whose seed phrase sat on disk in plain text should be treated as fully compromised.