VOLTA infostealer ranks stolen victim data with AI

Cisco Talos has identified VOLTA-AUTODOXER, also known as VOLTA, a Windows infostealer that uses large language models to turn stolen data into a ranked assessment of a victim’s potential financial value. The malware submits a structured evidence bundle through OpenRouter, defaulting to Anthropic’s Claude Opus 4.6 and falling back to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash.

The stated purpose is not merely to collect credentials. VOLTA instructs the model to generate a dossier that ranks monetizable valuables as low, medium or high and evaluates the victim’s operational security and password hygiene. Cisco Talos described the model as an operator’s triage analyst that converts a raw credential log into a prioritised, citation-backed victim assessment.

Credential theft followed by automated triage

VOLTA has the collection features associated with established stealer malware. It can harvest passwords and cookies from Chromium-based browsers, Outlook profile and Slack workspace data, payment cards, cryptocurrency wallet seed phrases, and sessions for Discord, Telegram, Steam and Roblox. It also targets Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles and screenshots.

The evidence bundle can include geolocation and home-address details, employer information, an inferred birth year, payment-card last four digits, Slack workspaces, document authorship metadata, iPhone backup indicators and a live Roblox account valuation. The malware also uses stolen Gmail session access to seek receipts from services including Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal, using those messages to corroborate an address and collect order-history information.

Model fallback is built into the workflow

VOLTA’s roughly 240-word system prompt assigns the model the role of a forensic intelligence analyst and restricts its factual input to the structured bundle. Its multi-model sequence checks responses for refusal language such as “I can’t” or “I’m not able” before passing the request to another model, allowing up to three models to be tried.

The campaign illustrates a threat pattern in which AI systems are used to classify and search data after compromise. The wider risk of AI systems being turned against their owners is also visible in AI models chaining vulnerabilities into exploits, where model capabilities were used to chain vulnerabilities into working exploits.

Telegram delivery and implications for defenders

VOLTA exfiltrates information to Telegram at three points: immediately after execution, after the AI call, and after the Gmail-based enrichment stage. The initial package can include browser credentials, cookies, payment cards, wallets, platform tokens, Wi-Fi passwords and screenshots; later deliveries add the AI analysis and enriched receipt data.

A six-slot build-time template holds settings including the Telegram channel and API keys. Talos said this structure may indicate a builder kit offered to customers or a bespoke operation that produces a custom binary for each order. In either case, the AI layer reduces the analytical effort needed to select valuable targets.

For businesses, the practical implication is to treat browser sessions, email access, cloud keys and AI API credentials as interconnected assets: endpoint monitoring, session revocation, credential rotation and controls over API-key storage should be prepared to operate together after a suspected infostealer infection.