VOLTA Infostealer Uses AI to Rank Stolen Victims

VOLTA is a Windows infostealer that extends the usual credential-theft workflow with an unusual post-compromise step: it asks a large language model (LLM) to assess the victim and rank the most valuable assets recovered from the machine and associated online accounts.

In its analysis, Cisco Talos describes the malware as a mature stealer with an optional AI integration layer. The implant collects a broad set of credentials, browser data, authentication sessions, wallet material, configuration files and screenshots. It then assembles a structured profile of the person using the compromised computer, enriches that profile through stolen sessions, and submits the resulting evidence to a third-party AI service for prioritization.

The significance is operational rather than merely technical. VOLTA does not use an LLM to deliver the initial infection or replace a conventional malware component. Instead, the model performs work that would traditionally require a criminal operator to review logs, connect scattered facts and decide which victims deserve further attention.

From broad collection to targeted assessment

According to Cisco Talos, the malware identifies itself as “VOLTA-AUTODOXER” and follows a staged workflow. The first stage is conventional infostealer activity, although the range of targeted data is extensive.

Talos reports that VOLTA can collect browser passwords, cookies and saved payment cards from Chromium-based browsers. It also targets Firefox and Thunderbird data, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, SSH material and cloud-provider configuration files. The research specifically mentions files and profiles associated with services including gcloud, OpenVPN and Hide.me.

The malware also seeks cryptocurrency information. Talos says VOLTA extracts wallet data and includes an embedded cracking component for wallet vaults. Its report records successful results in a line labeled “WALLET VAULTS CRACKED.” Saved Wi-Fi passwords are retrieved through Windows WLAN functionality and written in plaintext to the collection output.

Screenshots and Microsoft OAuth tokens are among the other collected material identified by the researchers. Taken together, the collection is designed to expose both directly monetizable assets and the identity, employment, communications and account relationships surrounding the user.

Session theft enables additional enrichment

VOLTA’s workflow does not end when local files and browser stores have been copied. Cisco Talos observed a network enrichment phase that uses stolen authenticated sessions to gather more information from online services.

For example, the malware can query a victim’s Gmail using an existing authenticated token and search for receipts associated with Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal. The stated purpose is to help establish or corroborate a home address. Stolen Uber Eats and DoorDash sessions can also be used to access order history directly.

Talos further reports that Discord tokens are reused to enrich the victim’s account profile. Roblox inventory is valued through a live lookup to rolimons[.]com. These actions illustrate why session theft can be more consequential than password theft alone: a valid session may provide immediate access to account data and transaction history without requiring the attacker to know the underlying password.

The resulting information is organized locally in a file named Identity_Report.txt. VOLTA serializes that material into JSON and submits it, together with an instruction set, to an LLM service. The returned analysis is stored as AI_Analysis.txt. Cisco Talos says the two files are then exfiltrated in an archive named volta_dox.zip.

Talos also observed other archive names associated with the workflow: volta_log.zip for an initial stealer report and volta_doxnet.zip when network enrichment produces additional material. The report describes exfiltration as potentially occurring in three stages rather than as one single transfer.

The LLM acts as a triage analyst

The AI component is configured to produce a victim assessment, not a generic summary. Cisco Talos reports that the prompt asks for a section titled “WHAT THEY’RE WORTH,” with assets ranked by monetization value using low, medium and high tiers. Another requested section, “THEIR OPSEC,” evaluates the victim’s security posture and password hygiene.

The model is also asked to make connections between sparse facts. Those connections may include relationships among names, addresses, universities and password patterns. The objective is to transform a raw credential log into a more actionable dossier supported by references to the collected evidence.

Talos identified an OpenRouter API endpoint in the sample: hxxps://openrouter[.]ai/api/v1/chat/completions. The default model was identified as anthropic/claude-opus-4.6, with a fallback sequence involving moonshotai/kimi-k2 and google/gemini-2.5-flash. The sample used a low temperature value of 0.2 and assembled JSON requests without an SDK. It also used a browser-like User-Agent.

These implementation details are confirmed observations from the analyzed sample. They should not be treated as evidence that every VOLTA deployment uses the same provider, model selection or configuration.

The fallback design is one of the more notable aspects of the sample. Talos says the malware checks model responses for refusal language, including phrases such as “I can’t” or “I’m not able,” and can move through a chain of as many as three models. The researchers assess this as evidence that the operator anticipated model refusals and designed the AI stage to continue when one provider declines the request. The implant can also operate without the LLM stage when no key is available.

Self-deletion and third-party infrastructure

Cisco Talos characterizes VOLTA as self-deleting. That behavior can reduce the amount of executable evidence left on a host after collection, although it does not eliminate all forensic opportunities.

The research identifies %APPDATA%\volta_debug.txt as an important artifact. Talos describes it as a timestamped harvest log containing a record of what the malware collected and whether the LLM request succeeded. Organizations investigating a suspected infection should preserve this file before cleanup or profile removal.

Talos also reports that the observed infrastructure was controlled by third parties rather than by infrastructure owned directly by the malware operator. The sample uses a build-template model with six swappable slots that are filled during compilation. Encrypted credentials in those slots are not considered strong protection because the derivation material is present in the binary. The researchers assess this design as consistent with a builder or commoditized malware model, in which customers supply their own values and receive customized binaries.

That assessment is not the same as confirmed attribution to a particular criminal group. The supplied research does not identify a named actor, victim set or campaign scope, and it does not establish how widely the analyzed build has been deployed.

Detection and response considerations

Defenders should approach VOLTA as both an endpoint theft problem and an identity-session compromise problem. A malware sample may disappear, while stolen cookies, OAuth tokens, wallet seeds and service sessions remain usable.

Cisco Talos highlights Chrome’s App-Bound Encryption (ABE) as a relevant defensive boundary. The researchers state that much of VOLTA’s token-stealing capability relies on techniques intended to bypass ABE and recommend application control that restricts which processes can launch Chrome with the --headless option. At minimum, organizations can alert when Chrome is launched headlessly by a process that is not an approved developer or automation tool. Such rules require tuning because legitimate testing and administration may use headless Chrome.

Endpoint telemetry should also be reviewed for unexpected access to browser profiles, wallet directories, SSH and cloud configuration files, saved Wi-Fi profiles, messaging applications and desktop screenshots. Archive creation involving names such as volta_log.zip, volta_dox.zip or volta_doxnet.zip may be useful as a hunt lead, but these filenames should not be treated as a complete signature.

Network monitoring can look for unusual outbound requests to the reported third-party AI endpoint, including requests made by processes that normally have no reason to contact an AI API. The endpoint should be treated as a lead rather than a definitive indicator, because the research notes that VOLTA uses swappable configuration and may operate without its AI stage. Organizations should also investigate unexpected traffic to services used for enrichment, while avoiding assumptions that any connection to those legitimate services proves infection.

What organizations should do now

• Protect browser and session data. Restrict unapproved processes from launching Chrome with --headless, monitor browser-profile access, and review application-control policies for unmanaged executables.
• Use hardware-backed credential storage where practical. Cisco Talos specifically recommends best practices for storing credentials in hardware-backed stores. Reduce the amount of reusable secret material kept in browsers and local configuration files.
• Preserve evidence during investigations. Before deleting suspicious files or rebuilding a host, collect %APPDATA%\volta_debug.txt, relevant endpoint telemetry, browser and identity-provider logs, and any suspicious archive files.
• Revoke sessions and rotate credentials. Treat browser cookies, OAuth tokens, messaging sessions, SSH keys and cloud-provider keys as potentially compromised when exposure is suspected. Password changes alone may not invalidate existing sessions.
• Handle exposed cryptocurrency seeds as a total loss of control. Talos advises that a seed phrase stored in plaintext should be considered fully compromised. Move funds to a new wallet whose seed is generated on an air-gapped device, following the organization’s approved process.
• Review identity and transaction activity. Check email access, mailbox searches, food-delivery and commerce accounts, Discord or other messaging sessions, cloud consoles and cryptocurrency activity for unauthorized use.

Conclusion

VOLTA demonstrates a shift from simply stealing data to automatically judging which stolen data matters most. Cisco Talos’s analysis shows an infostealer that combines broad collection, authenticated-session enrichment, self-deletion and model-assisted victim profiling. The AI layer does not make the malware autonomous in every sense, but it can reduce the operator’s manual review burden and help prioritize follow-on abuse.

The findings also reinforce a practical defensive lesson: endpoint cleanup is not enough. Organizations must assume that tokens, sessions, keys and wallet material may remain exposed after the executable disappears, and they should combine endpoint controls with rapid identity remediation and targeted evidence preservation.

Sources

Cisco Talos: “Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer”