Cisco Talos has published an analysis of VOLTA-AUTODOXER, a Windows information stealer that adds an unusual post-theft stage: after harvesting passwords, cookies, payment cards and crypto wallet material, it packages the loot into a structured identity report and hands it to a commercial large language model. The model is instructed to act as a forensic intelligence analyst and produce a target assessment — what the victim is worth, which accounts matter most, and how careless their security habits are. Talos researcher Ryan Fetterman published the findings on October 31, 2026.
- AI as analyst, not accelerator: The LLM stage does not make theft faster or broader; it removes the human work of sorting a raw credential log into a prioritized dossier.
- Refusal-shopping by design: VOLTA defaults to Anthropic’s Claude Opus, then falls back to Moonshot AI’s Kimi-K2 and Google’s Gemini 2.5 Flash if a model declines the request.
- No attacker infrastructure: Every endpoint observed belongs to a third party, and the inference round-trip runs from the victim’s own machine before any data is exfiltrated.
- Not yet seen in the wild: The sample surfaced through Talos’s CAIRN research effort, and there is no indication of real-world attacks.
What the stealer collects before the model weighs in
VOLTA is described as a mature implant, not a proof of concept. A single pass extracts browser passwords, cookies and saved payment cards from Chromium-based browsers, alongside data from Firefox, Thunderbird and Outlook. It also lifts session material from Slack, Steam, Battle.net, Discord, Telegram and Roblox, plus Microsoft OAuth tokens, SSH keys, cloud configuration files for gcloud, VPN profiles for OpenVPN and Hide.me, and saved Wi-Fi passwords dumped in plaintext through the Windows WlanGetProfileList interface. Screenshots of the desktop are captured as well.
Much of the token theft depends on bypassing Chrome’s App-Bound Encryption, a protection Google added to stop other processes from decrypting browser cookies. Talos ties that path to launching Chrome with the –headless flag. Cryptocurrency wallets receive special treatment: rather than simply copying vault files, VOLTA runs an embedded cracker on the victim’s machine and records the result on a line labeled WALLET VAULTS CRACKED in its own report.
A live enrichment pass then reuses the stolen sessions. With the victim’s authenticated Gmail tokens, the malware searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to corroborate a home address. It pulls order history from the food delivery services, enriches the Discord profile through the stolen token, and prices the victim’s Roblox inventory via a live lookup on Rolimons.com. The assembled bundle — geolocation, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata and iPhone backup indicators — is saved as Identity_Report.txt and serialized as JSON.
Inside the OpenRouter ranking stage
The serialized bundle is POSTed to OpenRouter’s chat-completions endpoint, a routing service that exposes many commercial and open-weight models behind a single API. The system prompt instructs the model to draft a target assessment with a WHAT THEY’RE WORTH section ranking valuables across low, medium and high monetization tiers, and a THEIR OPSEC section judging the victim’s security posture and password hygiene. The prompt also pushes the model to connect sparse data points — for instance, linking a victim’s name, address or university to patterns in their passwords.
The hardcoded configuration uses anthropic/claude-opus-4.6 as the default, with moonshotai/kimi-k2 and then google/gemini-2.5-flash as fallbacks. Requests are hand-assembled JSON with no SDK, carry a generic Mozilla/5.0 User-Agent, and run at a temperature of 0.2 — a setting Talos reads as a preference for consistent, repeatable output. VOLTA scans each response for refusal phrases such as “I can’t” and “I’m not able” before moving down the chain of up to three models. If no OpenRouter API key is present in the builder’s template slots, the malware skips the LLM stage entirely and behaves as a conventional stealer.
Talos describes VOLTA as “a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work,” framing the shift as “effort displacement.”
The model’s returned assessment is saved as AI_Analysis.txt, and exfiltration can occur in three staged archives: volta_log.zip after the stealer runs, volta_dox.zip after the AI call, and volta_doxnet.zip if the network enrichment produces anything. The report does not include statements from Anthropic, OpenRouter, Moonshot AI or Google, and it does not claim that any provider’s safeguards failed — only that the operator expected refusals and planned around them.
A builder model and the defensive gap
VOLTA is compiled from a template with six swappable slots filled at build time, including the Telegram channel, API keys and settings. Talos says this points to a builder model in which the author sells access, buyers supply their own values, and a custom binary is compiled per order. The analyzed binary carries a PE timestamp of August 17, 2026, and was first seen on October 11, 2026, placing development a few weeks before the public write-up.
Defensively, the most concrete lever is application control: restricting which processes may launch Chrome with the –headless flag blocks the App-Bound Encryption bypass path, and alerting on headless Chrome launches from unknown processes is a minimum fallback. Storing credentials in hardware-backed stores remains advisable. For organizations, the broader lesson concerns API keys: a stolen frontier-model key can fund attacker-controlled analysis at the key holder’s expense, and the usage may look like ordinary internal traffic until the bill arrives.
The significance of VOLTA is conceptual rather than technical. For years the bottleneck in cybercrime was not stealing data but making sense of it at scale. If a commercial model can do that sorting for cents, mass theft becomes more profitable without the attacker knowing anything more. The uncomfortable question Talos leaves open is one of responsibility: the difference between an assistant and an accomplice may rest on a refusal, and this malware is already built to keep asking until it finds a model that does not say no.
Sources & References