The Pulse
Cisco Talos Finds VOLTA Infostealer Using AI to Rank Victims
Cisco Talos says the VOLTA Windows infostealer sends stolen data to large language models to rank victims and their assets by potential value. The malware also uses stolen email and app sessions to enrich profiles before returning an AI-gen
AI.info Team · Written with AI · fact-checked ·
On October 31, Cisco Talos described a Windows infostealer that hands its stolen data to an AI model to decide which victims may be most valuable. The malware, which calls itself VOLTA-AUTODOXER, collects credentials and account sessions, builds a profile of the person behind the computer, then requests a ranked assessment of what can be monetized. Talos says the sample was first seen on October 11 and is designed to delete itself.
VOLTA builds a dossier from stolen accounts
The stealer takes browser passwords, cookies and payment-card details, along with cryptocurrency wallet information, messaging and gaming sessions, Microsoft OAuth tokens, SSH and cloud-service keys, saved Wi-Fi profiles and screenshots. It then compiles details such as a victim’s location, employer, home address, document-author metadata and the last four digits of payment cards into an identity report. The result is not just a credential dump: it is a structured profile intended to help an operator decide where to focus.
VOLTA also uses stolen sessions to gather more context. Talos says the malware searches Gmail for purchase receipts that may confirm a home address, retrieves Uber Eats and DoorDash order histories, and uses a Discord token to add account details. It can also check a Roblox account’s inventory value. Those findings are packaged with the other stolen information before the malware asks an external model to assess the target.
Claude, Kimi and Gemini form the fallback chain
The malware sends its bundle to OpenRouter with instructions for the model to act as a forensic intelligence analyst. The requested report includes a “WHAT THEY’RE WORTH” section that ranks assets by monetization potential, plus an assessment of the victim’s security practices. Talos says the default model is Anthropic’s Claude Opus 4.6, with Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash as fallbacks.
VOLTA checks model replies for refusal phrases such as “I can’t” or “I’m not able,” then tries the next model in its chain. Talos reads that design as evidence the malware’s operator anticipated refusals. The report also says the AI stage can be skipped if no key is available, so the stealer’s collection functions do not depend on a successful model response.
“The model is the operator's triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.”
Ryan Fetterman, Cisco Talos
A customizable build, with no attacker-owned infrastructure
Talos found that VOLTA uses a template with six configurable slots filled when the malware is built. The researchers say that setup suggests a builder model in which a customer supplies settings and receives a tailored executable; they caution that this is an inference from the sample’s design. Talos also found no attacker-owned infrastructure among the endpoints it observed.
The AI request runs through the infected computer’s own network connection, and the returned assessment is saved alongside the collected data before exfiltration. Talos describes the model integration as a way to reduce the operator’s analysis work, rather than as a feature that performs the initial theft. Its practical effect is to turn a broad haul of credentials and account data into a prioritized target report.
Talos points to Chrome’s headless launch path
Talos says part of VOLTA’s credential theft relies on bypassing Chrome’s App-Bound Encryption by launching Chrome in headless mode. Its recommended control is to restrict which processes can start Chrome with the --headless flag, or alert when an unapproved process does so. If a system is compromised, Talos advises preserving the timestamped %APPDATA%\volta_debug.txt harvest log, revoking potentially exposed tokens and changing passwords.
For cryptocurrency wallets, Talos says a seed phrase stored in plaintext on disk should be treated as compromised, with funds moved to a new wallet using a seed generated on an air-gapped device. The malware’s executable may erase itself, but the debug log can show what it collected and whether the model call succeeded.