A self-deleting Windows infostealer named VOLTA uses commercial AI models to turn stolen credentials, sessions, and cryptocurrency data into prioritized victim assessments.
The malware, self-named “VOLTA-AUTODOXER,” combines extensive collection capabilities with automated identity enrichment.
Its distinguishing feature is analytical outsourcing: after harvesting information, it asks a large language model to determine who the victim is, what they own, and which assets deserve the operator’s attention.
VOLTA submits a structured evidence bundle to OpenRouter, instructing the model to act as “a forensic intelligence analyst drafting a target assessment.”
Its requested report includes “WHAT THEY’RE WORTH,” ranking valuables into low, medium, or high monetization tiers, alongside “THEIR OPSEC,” assessing password hygiene and security posture.
The default model is anthropic/claude-opus-4.6, followed by moonshotai/kimi-k2 and google/gemini-2.5-flash.
VOLTA checks responses for refusal phrases such as “I can’t” and “I’m not able,” then advances through the fallback chain.
This explicitly anticipates safety guardrails, although switching models does not guarantee a successful response.
Requests use manually assembled JSON, a browser-like User-Agent, and a temperature of 0.2, favoring consistent output.
The inference request originates from the compromised machine before the resulting dossier is exfiltrated.
Cisco Talos researchers identified the malware, through their CAIRN research effort, revealing an optional intelligence layer that ranks compromised assets by monetization value rather than directing the initial theft.
VOLTA Infostealer
VOLTA targets browser passwords, cookies, payment cards, cryptocurrency seed phrases, Microsoft OAuth tokens, SSH keys, cloud configurations, Wi-Fi credentials, and screenshots.
Collection extends across messaging, gaming, and workplace applications, including Discord, Telegram, Steam, Roblox, and Slack. An embedded cracking component also attempts to recover cryptocurrency wallet vault contents.
Its enrichment stage reuses stolen authenticated access. Gmail searches retrieve shopping and delivery receipts to corroborate residential addresses; Uber Eats and DoorDash sessions expose order histories; Discord tokens reveal additional account information. A live Rolimons lookup estimates Roblox inventory value.
These findings become Identity_Report.txt, containing identity, employment, location, financial, and account indicators.
The model returns AI_Analysis.txt; both are packaged into volta_dox.zip. Separate archives, volta_log.zip and volta_doxnet.zip, support other collection stages.
Six build-time configuration slots suggest a customizable builder model, not confirmed commercial distribution.
Customer-specific credentials are encrypted using a key derived from constants inside the executable, making that protection recoverable through reverse engineering.
Observed communications rely on third-party services rather than attacker-owned infrastructure.
Defenders should monitor unexpected processes launching Chrome with –headless, a behavior associated with VOLTA’s App-Bound Encryption bypass path.
Application controls restricting unauthorized headless Chrome execution can disrupt that collection technique.
Responders should preserve %APPDATA%volta_debug.txt, a timestamped collection log that can survive executable deletion and indicate whether AI analysis succeeded.
Remediation includes revoking exposed sessions and tokens, resetting passwords, and migrating assets from wallets whose seed phrases were compromised.
The broader connection is effort displacement. Talos’ related CLOSEDQUORUM research documents models selecting tactical implant actions, although operational deployment remained unconfirmed.
VOLTA applies the same principle to post-theft analysis: converting indiscriminate collection into actionable criminal prioritization without requiring an operator to inspect every stolen record manually.
The AI layer therefore changes how stolen information is assessed, not the underlying need to detect credential theft and session abuse at source.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
