VOLTA Infostealer Uses AI to Price Victims on Their Own PC

Cisco Talos has documented VOLTA, a Windows infostealer that uses AI to appraise each victim: it sends the stolen data to a language model over the victim's own connection and gets back a ranked brief on what the haul is worth. The theft is ordinary. The triage is not, and it shortens the window defenders have to revoke sessions.

What did Cisco Talos find in the VOLTA infostealer?

Cisco Talos found a Windows stealer that runs ordinary credential theft and then hands the results to a language model. The report, “Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer,” was published October 31, 2026, and came out of a Talos research effort called CAIRN. The binary names itself VOLTA-AUTODOXER, which states its purpose.

Nothing in the theft chain needs AI. The new stage comes after the theft and turns a raw credential log into a ranked, citation-backed profile of the victim and their accounts:

“The novelty in the AI-integration is that it is not supporting a traditional malware capability but working as an intelligence analyst on behalf of the operator.”

Talos calls the pattern “effort displacement”: the operator’s manual work moves to the model. Stealer logs arrive by the thousands, and someone has to decide which hold a funded crypto wallet, a corporate SSO session or a cloud key, and which hold a teenager’s Steam account. VOLTA hands that triage to a model call.

The stage is optional. With no API key in the build, VOLTA runs as a plain stealer. The AI makes the haul easier to act on. It does not make the theft possible.

What does VOLTA steal before the model sees anything?

The collection pass is a wide, conventional sweep. From Chromium-based browsers it takes saved passwords, cookies and payment cards. It also reads Firefox and Thunderbird, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, Microsoft OAuth tokens and screenshots.

For engineering and IT teams, the keys matter most. VOLTA takes SSH keys and configuration files for gcloud, OpenVPN and Hide.me: footholds into infrastructure, not only consumer accounts.

Two details show the author wanted value extracted on the host. First, every saved Wi-Fi profile is dumped to plaintext through a direct call to the Windows WLAN API function WlanGetProfileList. An alert on enumeration alone proves little. Hunt for the full sequence: profile list, plaintext key read, and the file that received the dump.

Second, an embedded cracker runs against cryptocurrency wallet vaults during the same pass and writes the result to a report line labeled “WALLET VAULTS CRACKED.” Cracking does not wait for the operator.

Why does VOLTA call OpenRouter from the victim's machine?

The author chose to run no infrastructure, so the victim’s PC does the inference work. When collection finishes, VOLTA serializes the evidence bundle to JSON and POSTs it, with a system prompt, to OpenRouter’s chat-completions API. The JSON is assembled by hand with no SDK, and the request carries a spoofed Mozilla/5.0 user agent. The default model is anthropic/claude-opus-4.6. Temperature is hardcoded at 0.2, which favors consistent wording over varied guesses.

Identity_Report.txt is the local structured profile. The model’s reply is saved as AI_Analysis.txt. Both are packed with the rest of the haul into volta_dox.zip. Talos found no attacker-owned infrastructure: every observed endpoint belongs to a third party, and the main executable may delete itself after execution.

Three consequences follow for defenders:

• Attribution gets harder. The traffic is a call to a popular model router from a home or office IP, with no rented attacker server in the inference path.
• The victim pays for the side effects. Compute is billed to the operator’s key, but bandwidth, source IP reputation and exposure fall on the victim.
• There are two disclosures, not one. The JSON bundle leaves the host during inference. An upload of volta_dox.zip blocked at the egress proxy does not prove the data stayed on the host.

What is the model being asked to decide?

The model is asked to price the victim and judge how easy further abuse will be. The system prompt casts it as “a forensic intelligence analyst drafting a target assessment” and requires citations back to the evidence. “WHAT THEY’RE WORTH” ranks valuables by monetization potential in low, medium and high tiers. “THEIR OPSEC” grades security posture and password hygiene. The operator config adds: “Go deep, not wide… Be blunt, specific, accurate.”

The bundle holds more than a typical stealer log: geolocation, home address, employer and employer domain, an inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators and a live Roblox account valuation.

Before the call, VOLTA runs a live enrichment pass with the victim’s own stolen sessions. It searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm the home address, pulls Uber Eats and DoorDash order history, uses the Discord token to fill out the profile, and values the Roblox inventory through a live Rolimons lookup. That step exercises stolen cookies and tokens as authenticated sessions, which, depending on the service, need no password and no fresh MFA prompt. It happens before the operator opens the file.

The prompt also tells the model to connect sparse facts, such as linking a name, address or university to patterns in the victim’s passwords.

“The model is the operator’s triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.”

Temperature 0.2 makes sampling consistent, not true. Citations make a dossier look authoritative, and the model can still join the wrong facts. Treat those joins as claims, not findings.

How does a refusal become the next model in the chain?

VOLTA treats a refusal as an error. If a response contains phrases such as “I can’t” or “I’m not able,” it switches to moonshotai/kimi-k2 and then to google/gemini-2.5-flash, up to three models in the chain.

“This multi-model architecture suggests that the operator is anticipating encountering refusals, with the fallback pivoting to a few, smaller, and more permissive models.”

The attacker treats each model’s safety training as one configurable step, and a router with many models behind one key makes the swap trivial. A refusal from the flagship model does not stop the job. It moves the job to whichever model will answer. Talos does not report how often claude-opus-4.6 refused this prompt.

The framing helps too. “Forensic intelligence analyst” and “target assessment” sound like ordinary investigative work, so guardrail evaluations need to cover that role wrapper, not only raw jailbreak strings. The same applies to in-house LLM features: a control that lives only inside one model’s alignment fails once the caller can pick the model. We run LLM jailbreak and guardrail testing across the full routing path, fallbacks included, rather than against a single endpoint.

Is VOLTA a one-off or a product?

Talos treats VOLTA as a product. The code is a template with six configuration slots filled at build time, holding values such as the Telegram channel, API keys and settings. Talos reads that as a builder: the customer supplies values and gets a custom binary per order, each with its own keys, channels and victim pool. That is an inference from the template, not a confirmed sales ledger.

The slot secrets are encrypted with a key derived as the SHA-256 of two constants stored in the same binary. In Talos’s words: “The credentials in those slots are encrypted, but not in a meaningful way.” Anyone who reverses a sample can recover that customer’s API key and Telegram channel, which gives model providers a concrete key to revoke.

The analyzed sample is a PE32+ x86-64 binary with a PE timestamp of August 17, 2026, 20:35, first seen October 11, 2026 at 12:46 UTC. Pull the hashes and filenames from the Talos write-up rather than from secondhand copies.

Talos links VOLTA to the logic of a previously reported implant, CLOSEDQUORUM, applied to a different phase of an operation, without claiming a shared author. The source names no threat group, state sponsor, delivery vector, victim country or sector, and the number of builds in circulation is unknown. The collection looks consumer-heavy: Gmail, Discord, Roblox, delivery apps and wallets.

Talos closes on what comes next: “The question for defenders is not whether this pattern will appear elsewhere, but which phase it touches next.” Initial access, privilege escalation and extortion all involve analyst work a single model call could replace.

Why does AI triage shrink your response window?

The slow part of monetizing stealer logs was the sorting, not the theft. A human reads a fraction of what arrives, and a corporate session can sit among gaming accounts. That lag has quietly functioned as a defense. Talos puts it in one line: “there is a difference between a wide net and a wide net that sorts itself.”

If an employee’s personal laptop holds an SSO session, a gcloud config or an SSH key, the report can flag it before the archive reaches the operator. We saw a similar compression when autonomous agents stole thousands of credentials in six hours. VOLTA is the commodity version. Plan on a stolen session being abused within hours, and put the effort on session lifetime, token binding and revocation speed.

Preserve %APPDATA%\volta_debug.txt first. Talos describes it as a timestamped harvest log of what was collected and whether the LLM call succeeded, and it may be the best record left if the executable deleted itself. Keep Identity_Report.txt and AI_Analysis.txt if they remain, and handle all three as a sensitive dossier on your user.

Talos also names one host control: block or alert on Chrome launched with –headless, ideally through application control on which processes may start Chrome in that mode. Talos says this breaks the App-Bound Encryption bypass behind much of the token theft. App-Bound Encryption ties cookie decryption to Chrome itself, and a headless launch abuses the trusted browser rather than breaking the cryptography. Headless Chrome has legitimate automation uses, so record the parent process, full command line, user context and timeline.

From our engagements: the step teams most often skip is session revocation. A password reset does not reliably end browser sessions, OAuth grants, API tokens or SSH keys, and after simulated stealer infections we routinely find live sessions that survived the reset. For a VOLTA-class infection, work this list in the first hour:

• Revoke active web and desktop sessions with each provider, starting with SSO, email and Slack.
• Remove unexpected OAuth grants and invalidate Microsoft OAuth tokens.
• Replace SSH keys, gcloud credentials and VPN configs from a known-clean device.
• Rotate every browser-saved password and every Wi-Fi key stored on the host.
• If a wallet seed phrase sat in plaintext on disk, treat that wallet as fully compromised and move funds to a new wallet whose seed was generated on an air-gapped device.
• Scope the OpenRouter call and the zip exfiltration as two separate disclosures.
• Check the AI-generated reports against primary telemetry before you treat an address, employer or opsec claim as fact.

Attach that evidence to an identity record from the first hour, as we argued in AI agent incident response and the identity record.

FAQ

Does VOLTA need the LLM stage to steal credentials?

No. Without an API key in the build, VOLTA skips the model call and runs as a conventional stealer.

Which model does VOLTA call first?

anthropic/claude-opus-4.6 through OpenRouter at temperature 0.2. On refusal phrases like "I can't," it falls back to moonshotai/kimi-k2 and then google/gemini-2.5-flash.

Does stolen data leave before volta_dox.zip is exfiltrated?

Yes. The JSON bundle is posted to OpenRouter during inference, before Identity_Report.txt and AI_Analysis.txt are packed into the zip.

What is volta_debug.txt used for?

It is a timestamped harvest log in %APPDATA% that records what VOLTA collected and whether the LLM call succeeded. Preserve it, because the main executable may already have deleted itself.

If a VOLTA report on one of your employees would rate your SSO sessions, OAuth grants and cloud keys as high tier, test that path before a buyer does. agent::offense runs identity and session attack-path testing that starts from a stolen session and measures how far it still reaches.