VOLTA Infostealer Hands Stolen Data to Claude and Other AI Models to Rank Victims by What They’re Worth

A new Windows infostealer does something most stealers leave to a human operator: once it has emptied a victim’s computer of passwords, sessions and wallets, it hands the haul to a commercial AI model and asks for a ranked list of what that person is worth. Cisco Talos researcher Ryan Fetterman detailed the malware, which calls itself VOLTA-AUTODOXER, in a Talos threat spotlight published October 31, 2026, and outlets including WIRED and Tom’s Hardware have since dug into how it works.

The theft itself is familiar. What is new is the triage step, which turns raw stolen data into a dossier that tells criminals exactly where to aim next.

What VOLTA Steals

According to the Talos findings as summarized by Tom’s Hardware, WIRED and a technical breakdown from AgentBeam, VOLTA casts a very wide net. It collects saved passwords, cookies and payment cards from Chromium-based browsers and Firefox, Thunderbird and Outlook email profiles, Microsoft OAuth tokens, and active Discord, Telegram, Steam, Battle.net and Roblox sessions. It also grabs screenshots, document authorship metadata, SSH keys and cloud-provider configuration files, and it pulls every saved Wi-Fi password in plain text.

Cryptocurrency wallets get special treatment. Rather than simply copying wallet files, VOLTA tries to crack the wallet vaults on the spot. Much of its session theft depends on getting around Chrome’s App-Bound Encryption, which it does by launching Chrome in headless mode, without a visible window. After it finishes, the malware deletes itself.

“Volta is pretty mature as a stealer. It casts a pretty wide net for what it collects,” Fetterman told WIRED.

A Second Sweep Using the Victim’s Own Accounts

VOLTA does not stop at what is stored on disk. It uses the sessions it just stole to dig deeper. It searches the victim’s Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls food-delivery order histories, reuses a stolen Discord token to fill in the victim’s profile, and prices Roblox inventory through a third-party lookup service.

The result is an identity bundle that includes the victim’s approximate location and home address, employer and employer domain, an inferred birth year, and the last four digits of their payment cards. VOLTA writes this locally as Identity_Report.txt before converting it to structured data for the next stage.

How the AI Appraisal Works

The bundle is sent to OpenRouter, a service that routes requests to many different AI providers, over the victim’s own internet connection. VOLTA defaults to Anthropic’s Claude Opus 4.6 at a low temperature setting of 0.2, which keeps answers consistent from one victim to the next. Its roughly 240-word system prompt, quoted by WIRED, tells the model it is “a forensic intelligence analyst drafting a target assessment from a structured evidence bundle,” and asks for sections on what the victim is worth and on “their opsec,” including password habits. The prompt even instructs the model to “connect dots across fields,” such as checking whether a Wi-Fi password matches the victim’s last name.

The author clearly expected AI guardrails to push back. VOLTA scans each reply for refusal phrases and thin answers, then falls back to Moonshot AI’s Kimi K2 and, after that, Google’s Gemini 2.5 Flash. If the buyer of a build supplies no OpenRouter key at all, the malware simply skips the AI step and sends the raw dossier over Telegram. When the AI step works, the model’s answer is saved as AI_Analysis.txt and exfiltrated with the identity report in a single archive.

Built for Resale

Tom’s Hardware reports that VOLTA appears to be designed as a product. Its template has six swappable slots, for items such as a Telegram channel, API keys and settings, that are filled in when a custom binary is built for each customer. That means the buyer receives ranked victim assessments in a Telegram inbox without running any attacker-owned servers, which leaves fewer obvious points for defenders to block.

Talos found VOLTA through CAIRN, an open-source framework for hunting AI-integrated malware that it released in September 2026. The same effort earlier surfaced CLOSEDQUORUM, which Talos described on September 22 as the first reported autonomous AI command-and-control implant. Fetterman told WIRED that Talos did not track whether VOLTA has been used in the wild, and Talos has not attributed it to a specific actor.

Why It Matters for Business

Talos characterizes the AI stage as effort displacement rather than a new capability: the model does the sorting a human analyst would otherwise do by hand. That sounds modest, but it changes the economics of crime. Infostealer logs are often sold in bulk, and the slow part has always been figuring out which of thousands of victims are worth pursuing. Automated appraisal lets a low-skill buyer jump straight to the most valuable targets, whether that is a crypto holder, a person with a reused password, or an employee whose stolen tokens open the door to a company network.

That last point is the one business leaders should focus on. VOLTA explicitly records the victim’s employer and employer domain, and it steals Microsoft OAuth tokens, Slack workspaces, SSH keys and cloud configuration files. A personal laptop infected at home can become the first step in a corporate breach, and the AI report helps the attacker see that connection immediately. Because the AI call travels to a popular, legitimate service from the victim’s own connection, it also blends in with normal traffic.

The refusal-handling design is a warning sign too. As Tom’s Hardware notes, building in fallbacks across several model providers may become a standard feature of malware as AI integration matures, so guardrails at any single AI company are not a reliable defense on their own.

What Defenders Can Do

• Use application control to restrict which processes can launch Chrome in headless mode. Talos notes this blocks VOLTA’s path to decrypting Chrome-stored sessions, though it does not stop its other theft.
• Treat session tokens as credentials. When an infostealer infection is suspected, revoke OAuth and app sessions, not just passwords.
• Keep SSH keys and cloud credentials off personal and shared machines where possible, and rotate them after any endpoint compromise.
• Watch for unexpected traffic from endpoints to AI routing services, especially from machines or users with no business reason to call them.
• Push staff toward password managers and away from browser-saved passwords and reused credentials, the very habits VOLTA’s prompt asks the AI to grade.

The Bottom Line

VOLTA’s theft toolkit is standard, but its AI appraisal step shows where commodity malware is heading: steal everything, then let a model decide who is worth the effort. For businesses, the defense is the same discipline that stops ordinary stealers, applied faster, because the time between infection and a targeted follow-up attack is shrinking.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous