The VOLTA infostealer sends stolen data to Claude Opus 4.6 to rank victims by value

The sample names itself "VOLTA-AUTODOXER" and surfaced through the CAIRN research effort. It is a self-deleting PE32+ x86-64 Windows binary with a PE timestamp of 2026-08-17 and a first-seen date of 2026-10-11. Talos's point is that the model is not supporting a traditional malware capability. It works as an intelligence analyst on behalf of the operator, and every observed endpoint belongs to a third party.

Talos describes the collection as well beyond basic credential theft. In a single pass VOLTA takes browser credentials, cookies and saved payment cards across Chromium-based browsers, plus Firefox, Thunderbird and Outlook profiles. It also takes Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, Microsoft OAuth tokens, screenshots, and SSH and cloud-provider config files (gcloud, OpenVPN, Hide.me). Every saved Wi-Fi password is pulled through a direct call to WlanGetProfileList and dumped to plaintext. Cryptocurrency wallets are not just copied: an embedded cracker runs against the vault inline and writes the result to a WALLET VAULTS CRACKED line in the report.

Talos says the enrichment pass is what separates VOLTA from commodity stealers. Using the victim's own authenticated Gmail tokens, VOLTA searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address. It calls stolen Uber Eats and DoorDash sessions directly for order history, reuses the Discord token to enrich the account profile, and values Roblox inventory through a live Rolimons lookup. The resulting bundle includes geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators and a live Roblox account valuation.

The collected data is written locally to Identity_Report.txt, serialized to JSON, and POSTed with the system prompt to https://openrouter.ai/api/v1/chat/completions. The request is hand-assembled JSON with no SDK and a User-Agent of Mozilla/5.0. The required output has two sections. "WHAT THEY'RE WORTH" ranks valuables by monetization tier, and "THEIR OPSEC" assesses the victim's security posture and password hygiene. The response is saved as AI_Analysis.txt and exfiltrated with the report in volta_dox.zip.

The prompt asks the model to connect sparse, disparate data rather than find new data. For example, it encourages links between the victim's names, addresses or universities and the patterns in their passwords. Talos says the system prompt reveals the use case: a concise analytical assessment of the victim's suitability as a target, backed by an auditable trail of citations. Talos reads the hardcoded 0.2 temperature as the attacker emphasizing accuracy and consistency.

VOLTA checks each response for refusal phrases such as "I can't" or "I'm not able". If it finds one, it moves down a chain of up to three models: Claude Opus 4.6, then Kimi K2, then Gemini 2.5 Flash. Talos reads this as direct engineering effort by an author who expected to hit guardrails, with the fallback pivoting to smaller and more permissive models. The stealer also runs without the LLM stage entirely if no key is present. For anyone relying on model-side refusals as a control, a refusal in this design is one more branch, not the end of the pipeline.

The report does not say how often each model refused in practice, or which model produced the dossiers seen in the wild. The harvest log the malware writes records whether the LLM call succeeded, so that information exists on infected hosts, but the source does not summarize it. Talos says refusal resilience may become a standard design requirement as AI integration in malware matures.

VOLTA does not hardcode its Telegram channel, API keys or settings. Instead it uses a template with six swappable slots that are filled in at build time. Talos infers a builder model: the author sells access, each customer supplies their own values, and the builder compiles a custom binary per order. The slot contents are encrypted with a key derived as SHA-256 of two constants stored in the same binary, so anyone who reverses the file can recover them.

If the builder reading is correct, the dossier is a feature any customer gets, at any level of sophistication, delivered as ranked target assessments to a Telegram inbox. Recoverable slots also mean responders can extract the API keys a customer supplied from a sample. The source does not say whether recovered keys were reported to OpenRouter or revoked, and it does not describe any provider-side detection of this traffic.

Talos's concrete countermeasure targets the token theft. Much of VOLTA's token-stealing depends on bypassing Chrome's App-Bound Encryption (ABE). An application control policy that restricts which processes may launch Chrome with --headless would block the ABE decryption path entirely. At minimum, teams can alert when Chrome is launched with --headless by any process outside a known developer set. Talos also recommends hardware-backed credential stores.

Beyond the endpoint URL, the sample hash and the filenames, the report publishes no network indicators. Because every observed endpoint is third-party controlled, there is no attacker domain to block, and a blanket control on openrouter.ai would also hit legitimate use. The model-driven triage step does leave artifacts the report documents, and teams can hunt for them:

After a compromise, the main executable may already have deleted itself. Preserve %APPDATA%\volta_debug.txt, a timestamped harvest log that records exactly what was collected and whether the LLM call succeeded. Then revoke potentially compromised tokens and change passwords. If a wallet seed phrase was stored in plaintext on disk, treat the wallet as fully compromised and move funds to a new wallet whose seed was generated on an air-gapped device.

Commenters on Hacker News focused on delivery. One commenter worried that a single compromised update to a fast-moving, auto-updating tool could install something like VOLTA. Others proposed separate machines for banking, development, browsing, gaming and social accounts, QubesOS VMs, or a 7-day cooldown on updates. The source does not say how VOLTA reaches victims, so it neither supports nor rules out a supply-chain vector.

Another commenter asked whether isolation matters when machines share a network. The report documents single-host harvesting only and describes no lateral movement. Isolation does bear on what the model can do. VOLTA's value comes from cross-referencing Gmail receipts, delivery history, Discord, saved cards and password patterns on one host, so a machine that holds only development work gives the model less to correlate.

Talos frames the larger shift as effort displacement rather than speed or scale. It saw the same logic in CLOSEDQUORUM, applied to a different phase: find the step that needs the most sustained human attention and replace it with a model call. Talos says the question for defenders is which phase that pattern touches next. Its open question is whether effort displacement in crimeware lowers the operational floor, raises the ceiling on scale, or both.