VULNpocalypse
HighBreach / campaignMonitoring

VOLTA infostealer asks an AI which victims are worth robbing, then doxes them from their own Gmail

Cisco Talos found VOLTA, a Windows infostealer that grabs credentials, crypto wallets and Gmail data, then asks Claude, Kimi or Gemini to rank the victim.

Published
Updated
Exploitation
Not confirmed. Talos did not track whether VOLTA is used in the wild; one sample was first seen on 2026-10-11

What happened

Cisco Talos documented a Windows infostealer that calls itself VOLTA-AUTODOXER, surfaced through Talos’s CAIRN research effort, which tracks hacking tools that use AI (Cyber Security News). Talos researcher Ryan Fetterman wrote the report (Security Affairs), which was published on 31 October 2026 (Cyber Security News). Talos describes it as a mature stealer with an optional AI layer bolted on at the end, where the AI ranks stolen assets by monetization value rather than driving the initial theft (GBHackers).

What makes VOLTA unusual is that after it harvests data, it packages the data into an evidence bundle and sends it to an LLM through OpenRouter, a unified AI API gateway, with a system prompt that casts the model as “a forensic intelligence analyst drafting a target assessment” (The Hacker News). The system prompt is 240 words and tells the model the bundle is the only permissible source of facts; the required output has a “WHAT THEY’RE WORTH” section that ranks valuables low, medium or high by monetization, and a “THEIR OPSEC” section rating the victim’s security posture and password hygiene (The Hacker News).

The default model is Anthropic’s Claude Opus 4.6; if it refuses, VOLTA falls back to Moonshot AI’s Kimi K2, then Google’s Gemini 2.5 Flash (Security Affairs). VOLTA scans each reply for refusal phrases such as “I can’t” and “I’m not able,” and passes the request to the next model when it finds one, in a chain of up to three (The Hacker News). The requests are hand-built JSON with a browser-like User-Agent and a temperature of 0.2, and the inference call runs from the victim’s own machine over the victim’s own internet connection before the dossier is exfiltrated (GBHackers). If no API key is present, the malware simply runs without the AI stage (Security Affairs).

What it steals. VOLTA takes saved passwords, cookies and payment cards from Chromium-based browsers, plus data from Firefox, Thunderbird, Outlook and Slack (Cyber Security News). It grabs sessions from Discord, Telegram, Steam, Battle.net and Roblox, along with Microsoft OAuth tokens, SSH keys, cloud-provider credentials, saved Wi-Fi passwords and screenshots (Cyber Security News). It also tries to crack cryptocurrency wallet vaults on the spot (Cyber Security News). Much of the token theft depends on bypassing Chrome’s App-Bound Encryption (Cyber Security News).

How it doxes the victim. Using the victim’s logged-in Gmail session, VOLTA searches for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to corroborate the home address (The Hacker News). It reads order histories from stolen Uber Eats and DoorDash sessions, reuses the Discord token to fill in account details, and runs a live Rolimons lookup to price the victim’s Roblox inventory (GBHackers). The resulting profile can include geolocation and home address, employer and employer domain, an inferred birth year, the last four digits of payment cards, Slack workspaces, document authorship metadata and iPhone backup indicators (The Hacker News).

How the data leaves. The stealer writes Identity_Report.txt and receives AI_Analysis.txt, and packages output into archives named volta_log.zip, volta_dox.zip and volta_doxnet.zip, exfiltrated through a Telegram channel (Security Affairs). It deletes itself after running and uses third-party services rather than attacker-controlled servers (Security Affairs). Six build-time configuration slots, such as the Telegram channel and API keys, suggest the author may sell it as a builder, though Talos does not confirm commercial distribution (GBHackers).

Distribution, CVEs and attribution. The infection method is not described, no CVEs are involved, and no threat actor or group has been named (The Hacker News). Whether VOLTA has been used in the wild is not confirmed; per WIRED, Talos did not track that (Cyber Security News). One sample has a PE timestamp of 2026-08-17 and was first seen on 2026-10-11 (Cyber Security News).

Am I affected?

You are at risk only on Windows, which is the platform VOLTA targets (Security Affairs). Treat a machine as suspect if someone ran an unknown executable on it, especially one with a random name such as 9BY0tjwOc3ut.exe or yLP9m5J3i2Aw.exe (Cyber Security News).

Indicators of compromise reported by Talos (Cyber Security News):

  • A log file at %APPDATA%\volta_debug.txt, which is timestamped and can persist even after the executable deletes itself (GBHackers).
  • Files named Identity_Report.txt and AI_Analysis.txt, and archives volta_log.zip, volta_dox.zip and volta_doxnet.zip.
  • Sample SHA-256: 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.
  • Outbound requests to the OpenRouter chat completions API referencing the models anthropic/claude-opus-4.6, moonshotai/kimi-k2 or google/gemini-2.5-flash.
  • A Chrome process started with the --headless flag by an unknown parent process, which Talos links to the App-Bound Encryption bypass (GBHackers).

What to do now

Talos’s guidance, in order (Cyber Security News):

  1. Revoke tokens and reset passwords from a clean device, not the suspected machine, because any session on it may already be stolen (Cyber Security News).
  2. Move crypto funds to a new wallet if any seed phrase was stored in plain text on the machine (Cyber Security News).
  3. Preserve %APPDATA%\volta_debug.txt if you suspect infection, since it records the harvest and whether the AI analysis succeeded (Cyber Security News).
  4. Restrict and alert on Chrome launched with --headless using application control, so an unknown process cannot start it to bypass App-Bound Encryption (Security Affairs).
  5. Store credentials in hardware-backed stores rather than in browser or app profiles that a stealer can read (Security Affairs).
  6. Scan for the indicators above across your estate, including the sample hash, the output filenames and the OpenRouter model strings (Cyber Security News).

Sources