VOLTA infostealer uses LLMs to rank stolen victim assets by monetization value

A stealer with an analyst on call

Cisco Talos has documented a Windows infostealer that adds an unusual stage to the standard theft pipeline: after harvesting credentials, sessions and cryptocurrency wallets, it packages a structured dossier about the victim and sends it to a large language model, which returns a ranked assessment of what the stolen assets are worth. According to Talos, the malware — which brands itself VOLTA-AUTODOXER and surfaced through the CAIRN research effort — is a self-deleting implant that runs on no attacker-owned infrastructure. Every endpoint it touches belongs to a third party, and the writeup drew front-page attention on Hacker News.

The notable part, in Talos's reading, is that the AI layer does not support a conventional malware capability. It works as an intelligence analyst on behalf of the operator, turning a raw credential log into a prioritized, citation-backed profile of the person behind the machine.

Collect first, enrich second

In one pass, Talos says, the stealer grabs browser credentials, cookies and saved payment cards from Chromium-based browsers, along with Firefox and Thunderbird data, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram and Roblox sessions, Microsoft OAuth tokens, SSH keys, cloud-provider configuration files (including gcloud, OpenVPN and Hide.me), screenshots, and every saved Wi-Fi password, pulled through a direct Windows API call and written to plaintext. Cryptocurrency wallets are not merely copied: an embedded cracker runs against the vaults inline.

What separates VOLTA from commodity stealers is a live enrichment pass that abuses the victim's own authenticated sessions. Talos observed it searching the victim's Gmail for purchase receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to corroborate a home address, calling Uber Eats and DoorDash directly for order history, reusing the Discord token to flesh out the account, and valuing Roblox inventory through a live Rolimons lookup. The output lands in a local file, "Identity_Report.txt", holding geolocation and home address, employer and employer domain, an inferred birth year, card last-four digits, Slack workspaces, document authorship metadata, iPhone backup indicators and that Roblox valuation.

The model chain behind the dossier

That report is serialized as JSON and POSTed to OpenRouter under a system prompt that casts the model as a forensic intelligence analyst drafting a target assessment. The required output includes a section titled "WHAT THEY'RE WORTH", ranking valuables by monetization into low, medium and high tiers, and one titled "THEIR OPSEC", assessing the victim's security posture and password hygiene. The prompt also pushes the model to connect sparse, disparate data — for example linking names, addresses or universities to patterns in passwords — so the model stretches the stolen data into inferences rather than merely summarizing it.

The engineering is deliberate. According to Talos, the malware uses hand-assembled JSON with no SDK, a generic Mozilla user agent, a hardcoded temperature of 0.2 for consistent output, and a hardcoded model list. If a reply contains phrases like "I can't" or "I'm not able", VOLTA treats it as a refusal and fails over to a chain of up to three models; Talos observed anthropic/claude-opus-4.6 with moonshotai/kimi-k2 and google/gemini-2.5-flash behind it, interpreting the design as an explicit expectation of hitting guardrails and pivoting to smaller, more permissive models. The whole inference round trip runs on the victim's own machine and network connection, and the result — "AI_Analysis.txt" — is exfiltrated alongside the report in "volta_dox.zip". Exfiltration can occur in three stages: after the initial theft, after the AI call, and after network enrichment.

Built to be sold

Rather than hardcoding its Telegram channel, API keys and settings, VOLTA compiles from a template with six swappable slots filled at build time. Talos reads this as a builder model: the author sells access, the customer supplies values, and a custom binary is produced per order. The slot credentials are encrypted only nominally — the key is a SHA-256 of two constants inside the same binary, recoverable by anyone who reverses the file. If VOLTA is commoditized, the AI dossier is a product feature that lets a customer of any sophistication point the tool at victims and start receiving ranked target assessments in a Telegram inbox.

What defenders can do

Talos notes that much of the token theft depends on bypassing Chrome's App-Bound Encryption. An application control policy restricting which processes may launch Chrome with the --headless flag would block that decryption path outright, and at minimum, defenders can alert on headless Chrome launches.

Why it matters

This is a step-change in how criminals apply LLMs: not generating phishing lures or polymorphic code, but performing analytical triage of victims, collapsing skilled manual work into an automated step. It embodies a strategy Talos flags as emergent in cybercrime — sweep up everything indiscriminately, then let a model decide who deserves attention. The engineered refusal handling shows operators expect AI safety guardrails and route around them through permissive models, which matters for API providers whose services end up embedded in criminal pipelines. And because the abuse happens on victim machines via legitimate third-party services, with no attacker infrastructure to sinkhole, defenders have little to detect beyond host-side behavior.