VOLTA stealer: AI ranks victims by financial worth
Cisco Talos has published research on a Windows infostealer that does something unusual with the data it takes: it hands the whole bundle to a large language model and asks how much the victim is worth. The malware calls itself VOLTA-AUTODOXER, or VOLTA, and Talos researcher Ryan Fetterman documented it in a blog post published on 31 October 2026. Wider coverage followed on 2 November from The Hacker News and Help Net Security.
What it collects
VOLTA pulls saved credentials and cookies from Chromium browsers, payment cards, cryptocurrency wallet files and seed phrases, Microsoft OAuth tokens, SSH keys and cloud provider configuration, Outlook and Slack data, and session tokens for Discord, Telegram, Steam, Battle.net and Roblox. It dumps every saved Wi-Fi profile in plaintext, takes screenshots, and notes whether an iPhone backup is present. Talos also documents an embedded wallet cracker that logs a WALLET VAULTS CRACKED line when it succeeds. What distinguishes the sample is the packaging. Alongside the raw loot, VOLTA assembles what Talos calls a structured evidence bundle about the person behind the machine: geolocation and home address, employer and email domain, an inferred birth year, the last four digits of saved cards, Slack workspace names, document authorship metadata, and a live valuation of the victim's Roblox account pulled from Rolimons.A builder, not a campaign
VOLTA is not a single binary. Its settings live in six template slots filled at compile time, including the Telegram destination and the API keys used for the model calls. Fetterman reads it as a builder model: the author sells access and each customer supplies their own values, producing a separately compiled binary per order. The slot values are encrypted, but with a key derived from the SHA-256 of two constants stored in the same executable, which Talos calls not meaningful protection. The operational consequence is that there is no attacker-owned infrastructure to seize: every endpoint the sample contacts belongs to a third party. The stealer also deletes its main executable after running, leaving only a timestamped harvest log in APPDATA.Three archives, one Telegram inbox
Exfiltration happens in three passes, each producing its own archive delivered to the operator's Telegram:- volta_log.zip, sent immediately after collection, carrying credentials, cookies, cards, wallet data, session tokens, Wi-Fi passwords and screenshots.
- volta_dox.zip, sent after the model call, carrying the same material plus Identity_Report.txt and the model's response saved as AI_Analysis.txt.
- volta_doxnet.zip, sent only if the network enrichment stage returns anything, carrying Gmail receipt matches and order histories.
The prompt
Requests go to OpenRouter's chat completions endpoint with a hand-assembled JSON body, no SDK, temperature 0.2 and a browser user agent. The default model is anthropic/claude-opus-4.6. If the response looks like a refusal, the job retries against moonshotai/kimi-k2 and then google/gemini-2.5-flash, watching for strings such as I can't and I'm not able. The chain is capped at three models. The system prompt runs to roughly 240 words and casts the model as a forensic intelligence analyst drafting a target assessment. It instructs the model to treat the bundle as the only permissible source of facts and to ignore its own training knowledge about the subject. Required output sections include one headed WHAT THEY'RE WORTH, which ranks valuables by how easily they convert to money and tags each low, medium or high, and one headed THEIR OPSEC, which assesses security posture and password hygiene. It also asks the model to link personal identifiers, such as a name, address or university, to the passwords the victim chose.Identify the step that requires the most sustained human attention and replace it with a model call.The labour displaced is not collection, which every stealer automates, but triage: the reading and cross-referencing a buyer would otherwise do by hand.