A Thief With an Analyst
Infostealers are the most common malware on Windows today. They grab saved passwords, cookies and crypto wallets, then ship everything to an operator who decides what is worth using. That last step, deciding who is worth the effort, has always been human work.
VOLTA, also called VOLTA-AUTODOXER, hands that step to an AI. Cisco Talos first saw it on October 11, 2026 and published its analysis on October 31. It is sold as a builder, so each buyer gets a custom Windows binary (PE32+, x86-64) that deletes itself once the job is done.
What VOLTA Steals
- Browsers: saved passwords, cookies and payment cards.
- Apps: Outlook, Slack, Discord, Telegram, Steam and Roblox data.
- Technical secrets: SSH keys, cloud and VPN configuration files, crypto wallets and saved Wi-Fi passwords.
Then it goes a step further than a classic stealer. Using the sessions it just stole, VOLTA searches Gmail for retail receipts and pulls Uber Eats and DoorDash order history to confirm the victim's home address. Stolen data becomes a physical location.
The AI Stage, Step by Step
- Everything collected goes into a file called
Identity_Report.txt. - VOLTA converts it to JSON and sends it, with a system prompt, to the OpenRouter chat completions API at temperature 0.2.
- The default model is Claude Opus 4.6.
- VOLTA scans the reply for refusal phrases such as "I can't" or "I'm not able". If it finds one, it sends the same request to Kimi K2, then to Gemini 2.5 Flash.
- The answer is saved as
AI_Analysis.txt, and both files can be packed intovolta_dox.zipfor the operator.
The report has two sections. "WHAT THEY'RE WORTH" ranks the victim's assets as low, medium or high value. "THEIR OPSEC" judges their password habits. The data sent to the model includes the victim's home address, employer, inferred birth year, last four card digits and Slack workspaces.
Refusals Are Not a Security Control
The safety training of one model does work in the narrow sense: a refusal is a real outcome VOLTA had to plan for. But the attacker does not need every model to say yes. They need one. A simple string check and a list of fallbacks turns each refusal into a short delay. Model-level guardrails reduce misuse; they cannot be the only line of defense when attackers can shop across providers through a single API router.
What Really Changes: "Effort Displacement"
Talos calls this effort displacement. A stealer campaign can collect thousands of logs. Sorting them, finding the crypto holder, the company admin or the person with a saved corporate VPN profile, used to take time and skill. VOLTA turns that triage into one API call per victim.
Three details make this worth attention:
- The AI step is optional. Without an API key, VOLTA still steals and sends everything. The model does not make the theft possible; it decides who gets hit first.
- No attacker server to block. VOLTA relies only on third-party services. There is no classic command-and-control domain to add to a blocklist.
- Doxing at scale. Receipts and delivery history turn a stolen login into a home address. That raises the risk well beyond account takeover, toward extortion and physical threats.
How to Detect and Defend
| Signal or control | Why it matters |
|---|---|
Chrome launched with --headless | VOLTA uses headless Chrome to get around App-Bound Encryption. Use application control to limit which processes can do this, and at minimum alert when anything outside known developer tools does. |
| Calls to OpenRouter or LLM APIs | A finance laptop that never uses AI suddenly talking to an LLM router is a strong signal. Baseline which hosts use AI APIs and alert on the rest. |
| Files on disk | Look for Identity_Report.txt, AI_Analysis.txt, volta_dox.zip and %APPDATA%\volta_debug.txt. |
| Credential storage | Move credentials out of the browser into hardware-backed stores and password managers, and enforce phishing-resistant MFA so stolen cookies age out fast. |
Response Checklist
- Isolate the device and keep alerts and logs before cleaning.
- Keep
%APPDATA%\volta_debug.txt. The malware deletes itself, but this log can show what was collected and whether the AI call worked. - Reset passwords from a clean device, never from the infected one, starting with primary email and accounts that can reset others.
- Revoke sessions and tokens, including Slack, cloud and VPN access, and rotate SSH keys.
- Move crypto to a new wallet created on a clean, ideally air-gapped device if a seed phrase was stored in plain text.
- Involve your security team if any work credentials were on the machine.
The Fine Print
We also do not know how many buyers have the builder, or how often the AI stage is actually configured in real campaigns. The behavior is documented; the scale is not.
VOLTA is a Windows infostealer documented by Cisco Talos on October 31, 2026 that sends each victim's stolen profile to an AI model through OpenRouter, starting with Claude Opus 4.6 and falling back to Kimi K2 and Gemini 2.5 Flash after a refusal, to rank the victim's value and security habits. The AI stage is optional, but it turns the operator's triage into one API call. Defenders should watch headless Chrome launches and unexpected LLM API traffic.
Frequently Asked Questions
--headless by unexpected processes, calls to OpenRouter or other LLM APIs from machines that never use them, and files such as Identity_Report.txt, AI_Analysis.txt or %APPDATA%\volta_debug.txt.My Take
For two years, the debate was whether AI would write better malware. VOLTA shows a quieter shift: AI as the criminal's business analyst. It reads your receipts, your Slack workspaces and your password habits, then writes a short report on your value.
As a network security engineer, I see a clear lesson in where to look. The theft itself happens on the endpoint, but the AI stage needs to leave the network. Egress is where this kind of malware shows itself. A workstation sending personal data to an LLM router at 3 a.m. is now a detection rule worth writing, and most SOCs do not have it yet.
The second lesson is for AI providers and API routers. Refusals clearly happen, which is why VOLTA needs a fallback list. The next step is shared abuse signals across providers, so that a request refused by one model is not quietly answered by another.
Would your SOC notice a workstation sending your users' data to an AI model?
Sources:
- Gridinsoft: VOLTA Stealer asks AI to rank victims using stolen receipts and sessions
- AI-TLDR: Talos VOLTA infostealer, malware asks an LLM how much each victim is worth
- AI Chat Daily: Talos finds VOLTA infostealer using Claude to rank victims
- Spooky new infostealer malware uses AI to "autodox" victims
- ExplainX: VOLTA infostealer, what to do
This article is published for information purposes only, to help readers understand emerging AI security threats.
Related Articles:
- Russian State Hackers Used Claude Agents to Rewrite Their Malware Every Time It Got Caught
- One Attacker, Hundreds of AI Agents: How a Swarm Breached 395 Organizations Through PaperCut
- One Line in a Repository Runs Attacker Code Inside Seven AI Coding Agents
- I Built an AI SOC Agent, Then Tried to Hijack It
