Cisco Talos details VOLTA infostealer that asks Claude, Kimi and Gemini to rank stolen victim data
Cisco Talos has published an analysis of VOLTA-AUTODOXER, a self-deleting Windows infostealer that adds an optional large language model stage to the usual theft of passwords, cookies and crypto wallets. After collecting a victim's data, the malware can send a compiled identity report to the OpenRouter API and ask a model to write a target assessment that ranks what the victim is worth and how weak their security habits are. The hardcoded default model is anthropic/claude-opus-4.6, with moonshotai/kimi-k2 and google/gemini-2.5-flash configured as fallbacks if the first model refuses.
The report, written by Talos researcher Ryan Fetterman, was published on the Cisco Talos blog on October 31, 2026. Talos says the sample surfaced through CAIRN, its research effort for tracking malware that integrates AI. The analyzed binary carries a PE timestamp of August 17, 2026, and was first seen on October 11, 2026, at 12:46 UTC, which places the tool's development and first appearance a few weeks before the public write-up.
Talos frames the AI component as a late addition to an already capable stealer. In its own words, VOLTA is "a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work." The researchers describe the change as "effort displacement": the model does the sorting and appraisal that a criminal operator would otherwise do by hand when deciding which of many stolen profiles deserve attention first.
··········
HOW THE VOLTA INFOSTEALER CALLS CLAUDE, KIMI AND GEMINI THROUGH OPENROUTER.
The LLM stage is a plain HTTPS request to OpenRouter's chat completions endpoint, the routing service that exposes many commercial and open-weight models behind a single API. According to Talos, the JSON body is assembled by hand without any SDK, the request uses a generic Mozilla/5.0 User-Agent, and the sampling temperature is fixed at 0.2, a setting the researchers read as a preference for consistent, repeatable output over creative variation.
The model list is configured as a chain of up to three entries. VOLTA sends the report to the default model first and then scans the answer for refusal phrases such as "I can't" and "I'm not able". When it detects one, it moves on to the next model in the list. Talos interprets this logic as evidence that the operator expected refusals and planned around them, and it describes the fallback options as a pivot "to a few, smaller, and more permissive models."
........
Position in chain | Model identifier in the sample | Provider | Role |
1 | anthropic/claude-opus-4.6 | Anthropic | Hardcoded default |
2 | moonshotai/kimi-k2 | Moonshot AI | First fallback after a refusal |
3 | google/gemini-2.5-flash | Second fallback after a refusal |
........
The OpenRouter API key is stored in one of the builder's template slots. If no key is present, the malware skips the LLM stage entirely and behaves as a conventional stealer. Talos also stresses that every endpoint it observed belongs to a third party, so there is no attacker-owned server to block or seize. The inference round trip runs from the victim's own machine and network, before any data is exfiltrated, which means the AI request leaves the infected computer as ordinary-looking traffic to a legitimate API service.
The report does not include a statement from Anthropic, OpenRouter, Moonshot AI or Google, and it does not say whether Talos saw an LLM call succeed or fail in a real infection. The named models are the identifiers hardcoded in the analyzed sample; the report does not claim that any of the three providers' safeguards failed.
··········
WHAT VOLTA STEALS BEFORE THE AI ASSESSMENT.
The collection phase is extensive. Talos lists browser passwords, cookies and saved payment cards from Chromium-based browsers, data from Firefox, Thunderbird and Outlook, and session material from Slack, Steam, Battle.net, Discord, Telegram and Roblox. The stealer also takes Microsoft OAuth tokens, SSH and cloud configuration files such as gcloud settings, VPN configurations for OpenVPN and Hide.me, saved Wi-Fi passwords pulled through the Windows WlanGetProfileList interface and written out in plaintext, and screenshots of the desktop.
Much of the token theft depends on bypassing Chrome's App-Bound Encryption, the protection Google added to stop other processes from decrypting browser cookies. Talos ties this path to Chrome being launched with the --headless flag. Cryptocurrency wallets get special treatment: VOLTA runs an embedded cracker against wallet vaults on the victim's machine and records the outcome in a line labeled "WALLET VAULTS CRACKED" in its own report.
The stealer then uses the stolen sessions to enrich the profile. It searches the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, queries Uber Eats and DoorDash order history, reuses the stolen Discord token to add account details, and prices the victim's Roblox inventory through a live lookup on Rolimons, a third-party Roblox item valuation site.
........
Stage | Artifact produced | Content |
Collection | volta_log.zip | Credentials, sessions, wallets, Wi-Fi keys, screenshots |
AI assessment | Identity_Report.txt and AI_Analysis.txt, sent as volta_dox.zip | Compiled profile and the model's target assessment |
Enrichment | volta_doxnet.zip | Results of Gmail, delivery-app, Discord and Roblox lookups, if any |
........
Exfiltration happens in these three separate stages. The first archive leaves after collection, the second after the AI call, and the third only if the enrichment step returns something. A debug file at %APPDATA%\volta_debug.txt logs what was collected and whether the LLM request succeeded.
··········
THE VOLTA PROMPT: "WHAT THEY'RE WORTH" AND "THEIR OPSEC".
The system prompt recovered by Talos instructs the model to act as "a forensic intelligence analyst drafting a target assessment." The local data is first compiled into a text file named Identity_Report.txt, serialized as JSON and sent with that prompt. The model's answer is saved as AI_Analysis.txt.
The prompt requires two sections. The first, "WHAT THEY'RE WORTH," ranks the victim's valuables by how easily they can be monetized, using a qualitative low, medium and high scale. The second, "THEIR OPSEC," judges the victim's security posture and password hygiene. Talos reports that the output has to be citation-backed, tying each claim to evidence in the stolen data, and that the prompt asks the model to infer connections, for example by linking names, addresses or universities to the patterns in a person's passwords. The researchers point out that the model is being asked to extend the stolen data with its own reasoning, which goes further than summarizing it.
No numeric scoring system appears in the report, and Talos does not publish a sample of the AI-generated assessment. The structure of the prompt still shows the intended use clearly. A criminal who buys stolen logs in bulk normally has to read through each one to decide whether it holds a crypto wallet worth draining, a corporate cloud token or a gaming account with resale value. VOLTA hands that triage to a model and returns a ranked summary per victim.
··········
VOLTA AS A BUILDER PRODUCT FOR LOW-SKILL OPERATORS.
Talos assesses VOLTA as a builder-based product sold or shared with other criminals. Each build is generated from a template with six swappable slots that are filled in at build time with values such as the OpenRouter API key, a Telegram channel and other settings. The slot values are encrypted with a key derived from the SHA-256 hash of two constants stored in the binary, which Talos says offers no meaningful protection against analysis.
That design lowers the skill required to run the AI feature. According to Talos, a customer of any skill level could configure a build and "start receiving ranked target assessments in their Telegram inbox." The phrase captures the practical effect of the LLM layer: the operator receives a prioritized list instead of a pile of raw logs. Talos summarizes the point in one line: "There is a difference between a wide net and a wide net that sorts itself."
The report does not describe a distribution vector, a specific campaign, named victims, victim counts, attribution to a known group, CVEs or a MITRE ATT&CK mapping. The targets are individuals whose machines are infected, and the enrichment steps focus on consumer services common in the United States, such as DoorDash, Uber Eats, Grubhub and Walmart.
··········
DETECTING AND RESPONDING TO A VOLTA INFECTION.
Talos publishes one file hash and a small set of host and network indicators. Because the stealer deletes itself and uses only third-party services, defenders are left mainly with the files it writes and the behavior it shows on the endpoint.
........
Indicator type | Value |
SHA-256 | 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 |
File names | 9BY0tjwOc3ut.exe, yLP9m5J3i2Aw.exe |
File type | PE32+ x86-64 |
Network | openrouter[.]ai chat completions endpoint, Rolimons[.]com lookup |
Host artifacts | %APPDATA%\volta_debug.txt, volta_log.zip, volta_dox.zip, volta_doxnet.zip, Identity_Report.txt, AI_Analysis.txt |
........
The main preventive control Talos recommends is an application control policy that restricts which processes may launch Chrome with --headless, which would block the App-Bound Encryption bypass the stealer relies on. Security teams can also alert when Chrome starts in headless mode from a process outside known developer tools. Talos further recommends keeping credentials in hardware-backed stores rather than in browsers or files on disk.
After a suspected infection, Talos advises preserving %APPDATA%\volta_debug.txt even if the main executable has already deleted itself, since that file records exactly what was taken and whether the LLM call went through. Every token that may have been exposed should be revoked and every affected password changed. Any wallet whose seed phrase was stored in plaintext on the machine should be treated as fully compromised, with funds moved to a new wallet whose seed was generated on an air-gapped device.
For companies that run API platforms, the case shows a gap that model-level refusals alone do not close. The request reaches the model through a legitimate router with a valid key, from the victim's network, and the malware is built to try several models until one complies. Earlier reports covered on Data Studios, such as CrowdStrike's account of VAPOR PANDA using DeepSeek-powered agents and Unit 42's case of agentic AI in a post-exploitation intrusion, described AI used to run or speed up attacks. VOLTA applies models at a different point, after the theft, to decide which victims to exploit first.
··········
VOLTA-AUTODOXER: CONFIRMED FACTS AND OPEN QUESTIONS.
The established facts come from Talos' reverse engineering of the sample. VOLTA-AUTODOXER is a self-deleting Windows stealer with a broad collection module, an inline wallet cracker, an App-Bound Encryption bypass for Chrome, a three-stage exfiltration process and an optional LLM step that sends a compiled victim profile to OpenRouter. The default model is anthropic/claude-opus-4.6, followed by moonshotai/kimi-k2 and google/gemini-2.5-flash, and the code switches models when it detects refusal language. The prompt asks for a citation-backed assessment ranking the victim's assets by monetization value and judging their operational security. The tool is built from a six-slot template that makes the AI feature usable by low-skill buyers.
Several points remain unknown. Talos does not report how widely VOLTA has spread, how it reaches victims, who operates or sells it, or whether the LLM stage has produced assessments in real infections. The report also contains no response from Anthropic, OpenRouter, Moonshot AI or Google, so it is not known whether the keys involved have been identified or revoked, or how each default and fallback model actually answers the VOLTA prompt. Talos closes by treating the pattern as one that will spread to other parts of criminal tooling, with the open question being which phase of an attack it reaches next.
··········
FOLLOW US FOR MORE.
·····
DATA STUDIOS
·····
datastudios.org
