Cisco Talos has documented VOLTA, a Windows infostealer that hands its stolen data to commercial AI models to decide which victims are worth the most. In a report published October 31, Talos researcher Ryan Fetterman said VOLTA sends each victim profile to Anthropic's Claude Opus 4.6 through OpenRouter and asks the model to write a target assessment.
The AI step comes after the theft. VOLTA compiles what it collected into a file called Identity_Report.txt and posts it as hand-built JSON to OpenRouter's chat completions endpoint, with temperature set to 0.2 for consistent output and a generic Mozilla/5.0 user agent. The model's answer is saved as AI_Analysis.txt.
The malware is built to route around refusals. If the response contains refusal phrases, VOLTA retries with Moonshot AI's Kimi K2, then with Google's Gemini 2.5 Flash. If no API key is configured, it skips the LLM stage and runs as a conventional stealer.
Key facts
- 01Cisco Talos published its VOLTA analysis on October 31, 2026; the sample was first seen on October 11.
- 02VOLTA sends a compiled victim report to Claude Opus 4.6 via OpenRouter's chat completions API at temperature 0.2.
- 03If Claude refuses, VOLTA retries with Moonshot AI's Kimi K2, then Google's Gemini 2.5 Flash.
- 04The model returns a 'WHAT THEY'RE WORTH' ranking by low, medium and high monetization tiers plus a 'THEIR OPSEC' assessment.
- 05Talos says VOLTA is likely sold as a builder, with each customer receiving a binary compiled with their own Telegram channel and API keys.
The system prompt casts the model as a forensic intelligence analyst. It requires a section titled "WHAT THEY'RE WORTH," ranking the victim's valuables by low, medium or high monetization tier, and a section titled "THEIR OPSEC" covering security posture and password hygiene, with citations back to the stolen data.
The theft itself is broad. VOLTA takes browser passwords, cookies and saved payment cards from Chromium browsers, plus Firefox, Thunderbird and Outlook data. It also grabs Slack, Steam, Battle.net, Discord, Telegram and Roblox sessions, Microsoft OAuth tokens, SSH and cloud config files, cryptocurrency wallet data, Wi-Fi passwords and screenshots, and it runs an embedded cracker against wallet vaults.
VOLTA also uses stolen sessions to enrich its profile, for example searching Gmail for purchase receipts to confirm a home address and pulling food-delivery order history. Much of the token theft relies on bypassing Chrome's App-Bound Encryption. Results are packaged into zip archives at each stage, and the self-deleting executable may remove itself after running.
Talos assesses that VOLTA is likely a builder-model product. The author sells access, customers fill six template slots including a Telegram channel and API keys, and each order gets its own compiled binary. Talos called the key encryption weak because it derives from two constants stored in the same binary. All observed endpoints were third-party services, with no attacker-owned infrastructure identified.
The sample Talos analyzed carries a PE timestamp of August 17, 2026 and was first seen on October 11. VOLTA surfaced through CAIRN, Talos's research effort tracking AI-integrated malware.
For defenders, Talos recommends application control rules that block Chrome launches with the --headless flag from unapproved processes, which cuts off the decryption path, along with alerts on such launches. It also advises hardware-backed credential storage, preserving the volta_debug.txt harvest log after a suspected compromise, revoking exposed tokens, changing passwords, and treating any wallet with a plaintext seed phrase on disk as compromised.
Talos framed the AI layer as labor-saving rather than a jump in capability. "VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work," the report said, adding that "refusal resilience may become a standard design requirement" as AI integration in malware matures.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
