Cisco Talos details VOLTA infostealer's three-model fallback chain built around LLM refusals

A stealer that grades its victims

Cisco Talos has published an analysis of VOLTA, a Windows infostealer that adds an unusual step after emptying a victim's accounts: it hands the entire haul to a large language model and asks for a written appraisal of what the person is worth and how careless they are. According to the Talos report, published October 31, the analyzed sample was first seen on October 11, 2026, and labels itself "VOLTA-AUTODOXER" in its own code.

The theft side is conventional. Per Talos, VOLTA grabs browser passwords, cookies and payment cards, cryptocurrency wallet seed phrases, sessions for Discord, Telegram, Steam and Roblox, Microsoft OAuth tokens, SSH and cloud keys, Wi-Fi profiles rendered to plaintext, and screenshots, while an embedded cracker works on stolen wallet vaults inline. It then enriches the haul using the victim's own inbox — reading Gmail receipts from Amazon, PayPal and several food-delivery services to corroborate a home address — and prices a Roblox inventory through the Rolimons service.

A model chain built to survive refusals

The novel stage follows the theft. Talos says the malware assembles everything into an identity report, serializes it as JSON, and posts it to OpenRouter with a system prompt directing the model to role-play as a forensic analyst writing up the target. The required reply must rank the victim's valuables by monetization potential and critique their security habits. The output is stored beside the input and both files leave the machine together, with the inference round-trip running on the victim's own hardware and connection.

The notable detail is the model list. Requests default to anthropic/claude-opus-4.6, fall back to moonshotai/kimi-k2 and then google/gemini-2.5-flash, at a hardcoded temperature of 0.2, using hand-built JSON and a Mozilla user agent. When a reply arrives, VOLTA scans it for short refusal markers such as "I can't" or "I'm not able" and, on a match, rotates to the next model. Talos reads this as deliberate engineering: the authors assumed providers would decline and structured the malware to keep shopping until one doesn't. Exfiltration can happen in up to three waves — after the theft, after the AI call, and again if network enrichment produced anything.

A crude detector was enough

An independent writeup on dev.to implemented the refusal check exactly as quoted — a case-insensitive substring search for those two phrases — and tested it against 24 replies the author wrote themselves, half genuine refusals and half compliances. It caught six of twelve refusals and falsely flagged four compliances: 50 percent recall, 60 percent precision. Refusals phrased any other way passed untouched, while compliant answers that merely contained the phrase in ordinary usage were misread as rejections. The author adds a fair caveat: Talos says "phrases like", so the shipped binary may check more strings, and the score measures only the detector as published. The broader point stands regardless — the mechanism is a blunt substring check, and that sufficed to ship.

Scope limits and defenses

Talos is careful about what the find is not. The AI stage is optional; with no API key configured, VOLTA skips it and steals everything anyway. The sample appears built from a template with six swappable slots, and its obfuscation reduces to SHA-256 hashes of two constants in the same binary. No attacker-owned infrastructure was found — every endpoint is third-party. And Talos has not observed VOLTA in real attacks, has no victim count, and reports no case of a model actually producing the dossier during a live compromise.

For defenders, Talos's countermeasure is cheap: a policy controlling which processes may launch Chrome in headless mode blocks the App-Bound Encryption bypass that the token theft relies on. Anyone cleaning up should preserve the timestamped debug log the malware drops in %APPDATA%, which records what was taken and whether the LLM call succeeded, then revoke tokens and change passwords.

Why it matters

This is a design sighting, not an outbreak. Crimeware has absorbed a familiar enterprise habit — vendor redundancy — and applied it to model refusals, treating a "no" from one provider as a routing event rather than a verdict. Talos predicts refusal resilience may become a standard requirement in malware, much as effort displacement already has. If that lands, the guardrail quality of every aggregator-fronted model becomes part of the attack surface, and unusual inference traffic leaving an endpoint becomes a detection signal worth watching.