VOLTA Infostealer Uses Claude AI to Rank Victims by Resale Value After Data Theft

Cisco Talos has documented a self-deleting Windows infostealer called VOLTA-AUTODOXER. After it steals everything it can, it sends the haul to a large language model that ranks the victim’s value. The research, published October 31, 2026, by Ryan Fetterman, comes from Talos’s CAIRN effort, which tracks AI-integrated malware.

The idea behind VOLTA is simple: steal everything and let a model decide what matters. The usual haul includes browser passwords, cookies, payment cards, crypto wallet seed phrases, and Discord, Telegram, Steam, and Roblox sessions. It also takes Microsoft OAuth tokens, SSH and cloud keys, Wi-Fi profiles, and screenshots.

VOLTA then builds an evidence bundle about the person behind the machine. The bundle holds geolocation and home address, employer and employer domain, an inferred birth year, and card last-4 digits.

VOLTA Infostealer Uses Claude AI

It adds Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation. Talos says the AI layer does not add a traditional malware function. It acts as an intelligence analyst for the operator.

The collection reaches well past basic credential theft. It covers Chromium-based browsers, Firefox, Thunderbird, Outlook profiles and Slack. It also takes Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, and gcloud, OpenVPN and Hide.me configuration files.

Rather than just copying crypto wallets, it runs an embedded cracker against the vaults and records the result on a “WALLET VAULTS CRACKED” line in its report. Saved Wi-Fi passwords are dumped in plaintext through a call to WlanGetProfileList.

The enrichment pass is what separates VOLTA from commodity stealers. Using the victim’s own Gmail tokens, it searches for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to confirm a home address. It pulls Uber Eats and DoorDash order history from stolen sessions and reuses the Discord token to enrich the victim’s profile. It values Roblox inventory through a live Rolimons lookup.

The results are assembled locally in a file called Identity_Report.txt, serialized as JSON, and sent to OpenRouter. The model’s reply comes back as AI_Analysis.txt. Both files leave the machine together in volta_dox.zip. The whole inference round trip runs over the victim’s own network connection before exfiltration.

The system prompt tells the model to act as “a forensic intelligence analyst drafting a target assessment.” The required output has a section titled “WHAT THEY’RE WORTH,” which ranks valuables by monetization on a low, medium or high tier. A second section, “THEIR OPSEC,” assesses the victim’s security posture and password hygiene.

The prompt also asks for an auditable trail of citations and tells the model to “go deep, not wide.” It encourages links between sparse data points, such as tying names, addresses or universities to password patterns. Talos notes the model is asked to stretch the data into useful inferences, not to find new data.

VOLTA scans each response for refusal phrases such as “I can’t” or “I’m not able.” If it finds one, it moves down the chain of up to three models.

Talos reads this as deliberate engineering by an operator who expects to hit guardrails. The 0.2 temperature points to a preference for consistent, accurate output. The malware also runs without the LLM stage if no API key is present.

VOLTA appears to be sold as a builder. A template with six swappable slots holds the Telegram channel, API keys and settings, and the builder compiles a custom binary for each customer.

The slot credentials are encrypted, but the key is the SHA-256 of two constants in the same binary. Anyone who reverses the file can recover them.

If that reading is right, the dossier feature is a product for customers of any skill level, who receive ranked target assessments in Telegram. Talos found no actor-owned infrastructure. Every observed endpoint is third-party controlled, which removes the usual server-takedown option for defenders.

The stealer exfiltrates in up to three stages. The first is volta_log.zip after the stealer runs. The second is volta_dox.zip after the AI call. The third is volta_doxnet.zip if network enrichment produces anything.

Much of VOLTA’s token theft depends on bypassing Chrome’s App-Bound Encryption. Talos recommends an application control policy that restricts which processes may launch Chrome with –headless, which would block the decryption path.

At minimum, teams should alert when Chrome starts with –headless from any process outside a known developer set. Hardware-backed credential stores also help.

After a compromise, the executable may be gone, but the timestamped harvest log at %APPDATA%\volta_debug.txt may remain. It records what was collected and whether the LLM call succeeded, so preserve it.

Revoke potentially exposed tokens and change passwords. If a wallet seed phrase sat in plaintext on disk, treat the wallet as fully compromised. Move the funds to a new wallet with a seed generated on an air-gapped device.

Indicators of compromise

Talos calls VOLTA a mature stealer with a late-stage AI layer added to relieve the operator of analytical work. The gain is effort displacement, not speed or scale. It is the same logic seen in CLOSEDQUORUM, applied to a different phase of the attack. Both swap the step that needs the most sustained human attention for a model call.

Talos flags a second trend: refusal resilience may become a standard design requirement as AI integration in malware matures. The open question is whether this lowers the operational floor, raises the ceiling on scale, or does both. In Talos’s words, there is a difference between a wide net and a wide net that sorts itself.

I wrote this from the Talos post you supplied, and I confirmed the post’s title, date, author and summary on Talos’s blog. I could not load the full article page, so the technical details come from your pasted text. The quote placeholder is left in for your own commentary.

Site: Thecyberdef.com

Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.

About the Author

Kiran

Author

Kiran is an independent cybersecurity researcher covering vulnerabilities, malware campaigns, and emerging threats in the cybersecurity landscape.

Visit Website View All Posts