Cisco Talos reports that a Windows infostealer, VOLTA-AUTODOXER, steals a victim's data, asks an artificial intelligence model to rank their assets by value, and may delete itself. It uses Chrome headless to bypass App-Bound Encryption for some token theft and assembles an 'evidence bundle' for an AI target assessment.
VOLTA-AUTODOXER launches Chrome headless to bypass Chrome's App-Bound Encryption, a method used for much of its token theft. It also steals browser passwords, cookies and saved payment cards, email profiles, cloud-provider configuration files, SSH configuration files and plaintext Wi-Fi passwords. When cryptocurrency wallets are present, it attempts to crack their vaults inline.
The malware uses a system prompt instructing the AI to act as a "forensic intelligence analyst" and to be "blunt, specific, accurate." The default model is Anthropic's Claude Opus 4.6, set to a low temperature of 0.2 for predictable output. If it detects refusal phrases or thin replies, VOLTA looks to switch to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash, in that order. If the user supplies no OpenRouter API key, it can send the dossier over Telegram without the AI data.
Before the AI assessment, the malware performs what Cisco Talos calls "live enrichment" using stolen sessions. It searches the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, retrieves Uber Eats and DoorDash order histories, reuses a stolen Discord token to fill in the victim's profile, and values Roblox items through Rolimons. The inference call happens over the victim's own network connection. The stolen data is compiled into an Identity_Report.txt file, serialised to JSON, and sent to the LLM via the model router OpenRouter. The AI's analysis is saved as AI_Analysis.txt, and both files are exfiltrated together in a volta_dox.zip archive.
VOLTA appears to be a product designed for resale, with a template that contains six swappable slots for a Telegram channel, API keys, and settings filled at build time for each customer. Assuming everything goes to plan with the delivered build, the customer receives ranked target assessments in their Telegram inbox without relying on attacker-owned infrastructure.
After infection, the main executable may delete itself, while the victim should preserve a volta_debug.txt log showing what was collected and whether the LLM call succeeded. Cisco Talos says targets should revoke or rotate all API keys and tokens and change passwords, regardless of exposure; funds in any wallet whose seed phrase was stored in plaintext should be moved to a new wallet with a fresh seed, preferably generated on an air-gapped device. The report says VOLTA's AI use is relatively narrow and that refusal resilience may become a standard design requirement as AI integration in malware matures.
Analysis
Why This Matters
- Automated Targeting: The malware replaces the manual work of assessing a victim's financial worth and security posture with an AI model, making extortion and follow-on attacks more efficient for low-skill criminals.
- Victim-Hosted Operations: By running the AI inference over the victim's own network connection, the attacker avoids maintaining costly infrastructure, reducing the risk of disruption.
- Escalating AI Integration: VOLTA follows recent examples of LLM-powered malware, indicating that refusal resilience and AI-driven decision-making are quickly becoming standard capabilities in the cybercrime ecosystem.
Background
Information-stealing malware traditionally collects credentials and session data to be manually analysed or sold on criminal forums. VOLTA-AUTODOXER, reported by Cisco Talos in late 2026, automates this analysis by submitting the stolen data to a large language model, effectively creating a priority list of the most valuable targets. It is sold as a ready-made product, allowing other criminals to customise their own API keys and Telegram channels without building the malware themselves.
What to Watch
- Model Provider Response: How platforms such as Anthropic, Google, and OpenRouter respond to their models being systematically used for automated criminal victim assessment.
- Wider Adoption: Whether the commercial distribution model of VOLTA, combining AI analysis with a productised build service, is replicated in other malware families.
- Expansion of Capability: Whether the narrow analytical role of the AI expands to include autonomous exploitation and decision-making in future versions.
Checked
12 claims in this story checked against 1 source: 10 supported.
Show each claim
- SupportedVOLTA appears to be a product designed for resale.Latest from Tom's Hardware: “VOLTA appears to be a product designed for resale, as it has a template with six swappable slots — for a custom Telegram channel, API keys, and settings — that are filled at build time.”
- SupportedVOLTA uses AI to rank victims’ assets by value.Latest from Tom's Hardware: “The malware builds a structured “evidence bundle” on the person and asks the model for a list of their valuables ranked by how much they could be cashed out for”
- SupportedThe main executable may delete itself after infection.Latest from Tom's Hardware: “After infection, the main executable may delete itself, but a volta_debug.txt file should be preserved by the victim.”
- SupportedCisco Talos is the source reporting the malware’s behavior.Latest from Tom's Hardware: “A self-deleting Windows infostealer that calls itself VOLTA-AUTODOXER steals everything it can from a victim’s PC, then asks an AI model, Anthropic’s Claude by default, to turn the haul into a target assessment, Cisco’s Talos research organization reports .”
- SupportedVOLTA launches Chrome headless to bypass App-Bound Encryption for token theft.Latest from Tom's Hardware: “Much of the token theft relies on bypassing Chrome’s App-Bound Encryption (ABE), which VOLTA does by launching Chrome headless, that is, without a GUI.”
- Partly supportedVOLTA steals email profiles without limiting the claim to particular email clients.Latest from Tom's Hardware: “VOLTA steals browser passwords, cookies, and saved payment cards, Thunderbird and Outlook email profiles, Roblox accounts, Microsoft OAuth tokens, screenshots, and even SSH and cloud-provider configuration files.”
- SupportedWhen cryptocurrency wallets are present, VOLTA attempts to crack their vaults inline.Latest from Tom's Hardware: “Cryptocurrency wallets, when present, are not just copied, as the malware attempts to crack their vaults inline.”
- SupportedThe system prompt tells the AI to act as a “forensic intelligence analyst” and be “blunt, specific, accurate.”Latest from Tom's Hardware: “VOLTA operates with a prompt to act as “a forensic intelligence analyst” and to be “blunt, specific, accurate,””
- Partly supportedClaude Opus 4.6 is the default model, with temperature set to 0.2 for predictable output.Latest from Tom's Hardware: “The settings in use include Anthropic’s Claude Opus 4.6 by default, an older model released in February, at a temperature of 0.2. Temperature controls how random a model’s output is from a baseline 1.0, and the hardcoded low value suggests the operator prioritizes predictability.”
- SupportedIf it detects refusal phrases or thin replies, VOLTA switches to Kimi K2 and Gemini 2.5 Flash, in that order.Latest from Tom's Hardware: “VOLTA looks for refusal phrases and thin replies, switching to two other models, Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash, in that order.”
- SupportedBefore the AI assessment, VOLTA searches Gmail receipts to confirm a home address and enriches its dossier using stolen sessions.Latest from Tom's Hardware: “It also engages in live enrichment with any stolen sessions. VOLTA searches the victim’s Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to confirm a home address”
- SupportedIf the user supplies no OpenRouter API key, VOLTA can send the dossier over Telegram without the AI data.Latest from Tom's Hardware: “If the VOLTA user supplies no API key for OpenRouter, it can still send the dossier over Telegram without the AI data.”
