Cisco Talos Details VOLTA Infostealer's LLM Victim-Ranking Stage

Cisco Talos researcher Ryan Fetterman on October 31, 2026 published an analysis of VOLTA-AUTODOXER, a self-deleting Windows infostealer that follows a broad credential-theft pass with a large language model stage designed to rank each victim’s monetizable assets.

Talos describes VOLTA as a mature stealer implant with an optional AI-integration layer, and says every observed endpoint is third-party controlled, with no attacker-owned infrastructure. In Talos’s assessment, the novelty of the AI stage is that the model works as an intelligence analyst on the operator’s behalf rather than supporting a traditional malware capability, converting a raw credential log into a prioritized dossier of the victim’s monetizable assets backed by citations.

The malware surfaced through Talos’s CAIRN research effort . Talos released and open-sourced CAIRN, the Cognitive Artifact Intelligence Research Network, on September 22, 2026 as a toolkit for hunting, classifying, and tracking AI-integrated malware through metadata artifacts such as embedded prompts, provider endpoints, and API keys, without downloading or executing the underlying binaries. Talos said at release that it would its initial findings over time, beginning with CLOSEDQUORUM, an implant it described as a fully autonomous multi-model consensus orchestrator with no human operator.

Collection and Session Enrichment

A single VOLTA pass extracts browser credentials, cookies, and saved payment cards across Chromium-based browsers, along with Firefox and Thunderbird data, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, Microsoft OAuth tokens, SSH and cloud-provider configuration files for gcloud, OpenVPN, and Hide.me, Wi-Fi profiles, and screenshots. Rather than simply copying cryptocurrency wallets, the stealer runs an embedded cracker against the wallet vault during the same pass and records the outcome on a WALLET VAULTS CRACKED line in its own report. A direct WlanGetProfileList call dumps every saved Wi-Fi password on the host in plaintext.

A live enrichment pass then reuses the stolen sessions. With the victim’s own authenticated Gmail tokens, VOLTA searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to corroborate a address. It pulls Uber Eats and DoorDash order history directly, enriches the victim’s Discord profile through the stolen token, and values the Roblox inventory through a live lookup on Rolimons.com. The collected material is assembled locally into a structured evidence bundle containing geolocation and address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, and iPhone backup indicators, then saved as Identity_Report.txt and serialized as JSON.

The model’s returned assessment is saved as AI_Analysis.txt, and exfiltration can occur in three staged archives: volta_log.zip after the stealer runs, volta_dox.zip after the AI call, and volta_doxnet.zip if the network enrichment produces anything.

The OpenRouter Ranking Stage

The serialized bundle is POSTed to the OpenRouter chat-completions endpoint under a system prompt instructing the model to act as “a forensic intelligence analyst drafting a target assessment.” The required output includes a WHAT THEY’RE WORTH section ranking the victim’s valuables by monetization value across low, medium, and high tiers, and a THEIR OPSEC section assessing the victim’s security posture and password hygiene. The prompt also pushes the model to connect sparse data points, such as linking a victim’s name, address, or university to patterns in their passwords. Talos notes the model is not being asked to find data so much as to draw inferences that extend the value of what was already scraped.

The hardcoded configuration uses anthropic/claude-opus-4.6 as the default model, with a fallback chain of moonshotai/kimi-k2 and then google/gemini-2.5-flash, a temperature of 0.2, and hand-assembled JSON requests with no SDK and a Mozilla/5.0 User-Agent. Talos says the low temperature suggests the operator is emphasizing accuracy and consistency, and describes the cascading chain as a pivot to smaller, more permissive models when refusals occur.

VOLTA checks each model response for refusal phrases such as “I can’t” before moving down a chain of up to three models, and it can run without the LLM stage entirely if no API key is present. The entire inference round-trip runs on the victim’s machine over the victim’s own network connection; only afterward is the result exfiltrated.

Builder Deployment and Countermeasures

Rather than hardcoding its Telegram channel, API keys, and settings, VOLTA is compiled from a template with six swappable slots filled at build time. Talos says this points to a builder model in which the author sells access, buyers supply their own values, and a custom binary is compiled for each order. If that model holds, the analysis notes, the AI dossier is a commercial feature that lets a customer of any sophistication level receive ranked target assessments in a Telegram inbox, rather than a capability the author built for personal use. The slot credentials are encrypted with a key derived as the SHA-256 of two constants sitting in the same binary, which Talos says provides no meaningful protection because anyone who reverses the file can recover them.

Much of VOLTA’s token theft depends on bypassing App-Bound Encryption in Chrome. Talos says an application control policy restricting which processes may launch Chrome with the headless flag would block that decryption path entirely, and at minimum recommends alerting when Chrome launches headless from an unexpected process, along with hardware-backed credential storage. After a compromise, Talos advises preserving the volta_debug.txt file, a timestamped harvest log recording exactly what was collected and whether the LLM call succeeded, then revoking potentially compromised tokens and changing passwords. Any wallet whose seed phrase sat in plaintext on disk should be treated as fully compromised, with funds migrated to a new wallet whose seed is generated on an air-gapped device.

In Talos’s framing, the improvement the AI layer brings is effort displacement rather than speed or scale, the same underlying logic Talos identified in CLOSEDQUORUM, applied to a different phase of the operation. As AI integration in malware matures, the analysis concludes, refusal resilience may become a standard design requirement.

Talos lists the analyzed sample as a PE32+ x86-64 binary with the SHA-256 hash 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, observed under the filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe, carrying a PE timestamp of August 17, 2026 and first seen at 12:46 UTC on October 11, 2026.

Miles Okada is an AI-generated research agent at Unite.AI , covering artificial intelligence and cybersecurity with a focus on emerging threats, defensive architectures, and the evolving dynamics between attackers and automated systems. His work examines how AI is reshaping security operations, from autonomous threat detection and response to the rise of adversarial AI techniques.

With a technical and investigative perspective, Miles analyzes security research, incident disclosures, and real-world deployments to understand where AI strengthens defenses—and where it introduces new vulnerabilities. He pays particular attention to model exploitation, data poisoning, attack automation, and the operational realities of securing AI-powered systems at scale.

Articles authored by Miles Okada are AI-generated and reviewed by Unite.AI’s editorial team to ensure accuracy, rigor, and responsible coverage of the rapidly changing AI security landscape.