VOLTA Stealer Asks AI What Victims Are Worth

A Windows infostealer called VOLTA sends a dossier on each victim to a commercial AI model and asks it to rank what the stolen data is worth, Cisco Talos said in an analysis published Saturday, Oct. 31. The malware routes the request through OpenRouter to Anthropic's Claude Opus 4.6 by default and switches to Moonshot AI's Kimi K2 or Google's Gemini 2.5 Flash when it detects a refusal.

Key takeaways

• VOLTA asks an LLM to produce a "WHAT THEY'RE WORTH" ranking of each victim's valuables and a "THEIR OPSEC" read on their security habits.
• The code checks replies for refusal phrases and fails over across up to three models, a design Talos says "may become a standard design requirement."
• Talos says the stealer is self-deleting and uses no attacker-owned infrastructure, leaving defenders few network indicators to block.

How the VOLTA infostealer uses an LLM

Talos researcher Ryan Fetterman describes VOLTA, which the team also labels VOLTA-AUTODOXER, as a 64-bit Windows executable that first does what most stealers do. It takes browser passwords, cookies and saved payment cards; Discord, Telegram, Steam and Roblox sessions; Microsoft OAuth tokens; SSH and cloud keys; Wi-Fi passwords; screenshots; and crypto wallet seed phrases. A built-in cracker tries to open wallet vaults it finds.

It then builds an identity report. Using stolen sessions, it searches the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls food-delivery order history and checks the value of Roblox items through a live lookup. The report can include employer, inferred birth year, the last four digits of a card and Slack workspaces.

That file is sent to OpenRouter's chat completions endpoint at a temperature of 0.2. The system prompt casts the model as a forensic intelligence analyst writing a target assessment and tells it to "Go deep, not wide" and "Be blunt, specific, accurate." It also asks the model to connect names, addresses or schools to likely password patterns. The answer is saved as AI_Analysis.txt and zipped with the report for the operator.

Refusal fallback across Claude, Kimi and Gemini

VOLTA does not assume the first model will cooperate. If a reply contains phrases such as "I can't" or "I'm not able," it retries with moonshotai/kimi-k2 and then google/gemini-2.5-flash. Talos reads this as operators planning around safety training rather than hoping to avoid it.

The sample's compile timestamp is Aug. 17, 2026, and Talos lists it as first seen on Oct. 11. A template with six swappable slots, including a Telegram channel and API keys, points to a builder model in which the author sells custom binaries to buyers, according to the report.

Context: from AI-written commands to AI appraisal

Malware calling LLMs at run time is now a recurring pattern. In November 2025, Google Threat Intelligence Group reported PROMPTSTEAL, linked to Russia's APT28, as the first malware it saw querying an LLM in live operations, in that case to generate Windows commands. On Sept. 22, Talos detailed CLOSEDQUORUM, an implant that lets four commercial models vote on its next move. AI Newsway has also covered attackers who ran agents to rebuild malware until scanners stopped catching it.

VOLTA applies the model to a different job: analysis. "VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work," Talos wrote. "The axis of AI improvement here is not speed or scale but effort displacement."

What's next for defenders

Talos recommends application control that limits which processes can launch Chrome in headless mode, alerts on headless Chrome started by unknown processes, and hardware-backed credential storage. Responders should keep the %APPDATA%\volta_debug.txt log, which shows what was taken and whether the AI call succeeded, then revoke tokens and change passwords. A wallet whose seed phrase sat in plain text should be treated as fully compromised and emptied into a new wallet created on an air-gapped device.

FAQ

Did Claude or the other models help the attackers?

VOLTA is built to send its request to Claude Opus 4.6 first and to move to Kimi K2 and Gemini 2.5 Flash if it detects a refusal. Talos's report describes that logic; it does not say how often each model complied.

Can defenders block VOLTA's network traffic?

Not easily. Talos says all observed endpoints, including OpenRouter's API, are run by third parties, and there is no attacker-owned server. Detection relies on behavior such as headless Chrome launches and the files the malware writes.

What should a possible victim do first?

Preserve volta_debug.txt, revoke sessions and tokens, change passwords and move any crypto whose seed phrase was stored on disk to a new wallet.

References

• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer — Cisco Talos (Oct. 31, 2026)
• GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools — Google Threat Intelligence Group (Nov. 5, 2025)