VOLTA: Infostealer Uses LLMs to Assess Stolen Data and Prioritize High-Value Victims

1. Basic Information Article Name: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer Publisher: Cisco Talos Publication Date: 2026-10-31 Original Source: Cisco Talos Related Sources: None Associated Malware: VOLTA, VOLTA-AUTODOXER Associated Threat Groups: None specified Associated CVEs: None specified Affected Products: Windows, OpenRouter API, Chromium-based browsers, Firefox, Thunderbird, Outlook, Discord, Telegram, Slack, Steam, Battle.net, Roblox Severity: high 2. Executive Summary Cisco Talos analyzed a sample of the Windows infostealer VOLTA-AUTODOXER. They observed an implementation where the stealer collects credentials, sessions, and wallet information, sends the evidence bundle to an LLM via OpenRouter, and ranks the victim based on financial value and OPSEC. Talos analyzed a sample, and no actual victim counts or subsequent compromises using the AI assessment results have been confirmed. This implementation is notable because it broadly steals credentials, sessions, and wallet seeds, uses the stolen sessions for additional enrichment, and has an LLM assess victim value. This allows for the automation of manual triage to prioritize follow-on attacks. 3. Attack Flow Collection, Session Reuse, and AI Assessment VOLTA collects browser data, messaging apps, games, crypto wallets, cloud settings, Wi-Fi profiles, and screenshots. The initial execution vector is unknown. It reuses stolen Gmail, delivery service, and Discord sessions from the victim host to gather addresses, purchase histories, profiles, and asset values. It formats Identity_Report.txt into JSON and sends it to OpenRouter, prompting the default or fallback model to assess the victim's monetization value and OPSEC. It saves the AI response in AI_Analysis.txt and sends it externally as volta_dox.zip along with the collected data. The LLM processing is optional. Talos describes three transmission stages: volta_log.zip immediately after data theft, volta_dox.zip after AI processing, and volta_doxnet.zip when acquiring additional information. A failure in AI processing does not mean that the prior theft or transmission failed. Artifact Removal The main executable self-deletes. Artifacts such as %APPDATA%\volta_debug.txt, Identity_Report.txt, AI_Analysis.txt, volta_log.zip, and volta_dox.zip may remain. 4. Attacker Position and Execution Location The malware collects credentials and sessions on a Windows endpoint, and connects to third-party APIs and destination servers directly from the victim host's network. 5. Impact on Victims and Administrators Victims Mail, delivery, messaging, and wallet information may be collected without any visible screen activity. Administrators Indicators include unauthorized processes running Chrome in headless mode (--headless), requests to the OpenRouter API, session reuse across multiple services, VOLTA files in the APPDATA directory, archive creation, and outbound traffic to services like Telegram. 6. Success and Failure Conditions Success Conditions A VOLTA sample must execute successfully on a Windows endpoint. Target browsers, applications, or wallets must contain reachable credentials, sessions, seed phrases, or profile data. AI assessment requires a valid OpenRouter API key and network connectivity to the API. However, the data theft functionality can still operate without an API key. Failure Conditions and Countermeasures Use application control to restrict unknown binaries and unauthorized processes from launching Chrome with --headless. Implement hardware-backed credential storage, MFA, short-lived tokens, and offline storage for wallet seed phrases. Because MFA alone does not prevent the reuse of stolen sessions, revoke compromised tokens and sessions at the issuer immediately. Monitor egress traffic to detect and block unauthorized processes from communicating with OpenRouter, Telegram, and other consumer services. 7. What Happens Upon Success Theft of credentials, OAuth tokens, sessions, payment cards, wallet seeds, and SSH or cloud keys. Additional collection of addresses, purchase histories, and profiles using stolen sessions. Automated ranking of victim value by an LLM, enabling prioritized fraud, account takeover, or wallet theft. 8. Observable Logs Inference: The following are potential log sources to investigate within your organization. Availability depends on logging configurations and product visibility, and primary sources do not guarantee every item was recorded. Email: Check for receipt searches and mail access using stolen Gmail tokens. Proxy / SWG / DNS: Check for unauthorized process traffic to OpenRouter chat completions, Telegram, delivery services, and Roblox or Rolimons. Endpoint / EDR: Check for unknown PE execution, Chrome running with --headless, browser database access, %APPDATA%\volta_debug.txt, Identity_Report.txt, AI_Analysis.txt, volta_*.zip files, and self-deletion. Identity / IdP: Check for Microsoft OAuth token usage, mailbox access, Slack or Discord session usage, and anomalous locations or devices. SaaS / Cloud: Check for Gmail receipt searches, delivery service order histories, Discord profiles, and the use of cloud-provider credentials. Network: Correlate TLS traffic from the victim host to OpenRouter and third-party destinations using process telemetry. 9. Determining Attack Success Inference: The following criteria are based on publicly disclosed information or internal evaluation standards. Contact and success are treated separately. Confirm Initial Execution: Criteria: Verify the presence of the VOLTA sample process, volta_debug.txt, Identity_Report.txt, or collected ZIP archives. Target: Windows endpoint. Confirm Data Theft or Session Compromise: Criteria: Verify the contents of credentials collected by VOLTA, successful access to authenticated resources using stolen tokens, or the successful external transmission of collected data. The mere presence of AI_Analysis.txt or transmission attempts does not confirm successful data exfiltration or follow-on compromise, nor does an AI call failure indicate that theft failed. Target: Endpoint / SaaS session / wallet. 10. Investigation Playbook Inference: This is a recommended internal investigation procedure. Trigger: VOLTA hash, unknown PE self-deletion, OpenRouter traffic, VOLTA file names, or unauthorized Chrome --headless activity. Initial Checks: Verify process trees, execution times, users, network connections, target browsers or applications, and the presence of wallet or cloud keys. Endpoint: Preserve memory, disk, and EDR telemetry while collecting %APPDATA%\volta_debug.txt, Identity_Report.txt, AI_Analysis.txt, volta_log.zip, volta_dox.zip, and volta_doxnet.zip. Identity and Cloud: Check and revoke sessions and tokens for Microsoft, Google, Slack, Discord, Telegram, Steam, Roblox, and cloud providers. Follow-On: Track mail receipt searches, delivery history access, wallet transfers, cloud or SSH logins, and account takeovers. Containment: Isolate the device, and revoke or update any exposed passwords, tokens, API keys, and SSH keys. If wallet seed phrases were stored on disk, transfer assets to a new wallet generated in an air-gapped environment. Classification: Record sample execution, successful data collection, session reuse, AI assessment, external transmission, and follow-on fraud in separate stages. 11. Defense and Detection Ideas Single Event: Detect unauthorized processes launching Chrome with --headless, OpenRouter chat completions, and the creation of VOLTA-specific files. Time Series: Correlate unknown PE execution, browser and wallet access, continuous consumer API connections, Identity_Report/ZIP creation, OpenRouter communication, and external data exfiltration. Threat Hunting: Search for the VOLTA SHA-256 hash, %APPDATA%\volta_debug.txt, volta_*.zip files, and endpoint process traffic targeting the OpenRouter endpoint. Logging Gaps: TLS encryption and third-party service usage may prevent network destination logs alone from confirming malicious activity, and self-deletion can leave no binary behind. Priority Controls: Prioritize application control, browser credential protection, session revocation procedures, offline storage for wallet seeds, and process-aware egress monitoring. 12. Facts / Inference / Hypothesis Facts Talos analyzed a Windows PE sample of VOLTA-AUTODOXER that emerged from CAIRN research. The SHA-256 hash is 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, and it was first seen on October 11, 2026, at 12:46 UTC. VOLTA collects browser passwords, cookies, saved payment cards, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, cryptocurrency wallet seed phrases, and Discord, Telegram, Steam, and Roblox sessions. It uses stolen Gmail tokens to search purchase receipts, retrieves order histories from Uber Eats and DoorDash, views Discord profiles, and assesses Roblox inventories to enrich profiles with addresses, employers, estimated birth years, card last-four digits, and Slack workspaces. It formats Identity_Report.txt into JSON and sends it from the victim host to the OpenRouter chat completions endpoint. The default model is anthropic/claude-opus-4.6, with moonshotai/kimi-k2 and google/gemini-2.5-flash used as fallbacks upon rejection or failure. The system prompt instructs the LLM to evaluate financial value and OPSEC, and perform a target assessment ranking monetization value as low, medium, or high. The response is saved as AI_Analysis.txt and included in volta_dox.zip for transmission. The executable self-deletes, and the observed endpoints belong to third-party services. Talos has not identified infrastructure owned by the threat actor. While Talos suggests a builder-based sales model, sales records, operators, distribution vectors, victim counts, and successful follow-on compromises have not been confirmed. Inference Inference: Because OpenRouter traffic alone cannot confirm malicious intent, analysts must correlate it with preceding credential access, headless browser execution, VOLTA artifacts in APPDATA, archive creation, and external transmission. Hypothesis No additional hypotheses. Unverified items are listed under Uncertainties and Limitations. 13. MITRE ATT&CK Mapping ID Technique Confidence Basis T1555.003 Credentials from Web Browsers high Implementation collects browser passwords, cookies, and saved cards. T1528 Steal Application Access Token high Implementation collects and reuses session tokens for Microsoft OAuth, Discord, and other services. T1567 Exfiltration Over Web Service high Talos describes an implementation that packages collected data and AI analysis into a ZIP file and sends it to third-party web services such as Telegram. Use of alternate C2 channels is not assumed. Actual victim counts are unknown. T1070.004 File Deletion high Implementation causes the main executable to self-delete. 14. Uncertainties and Limitations Initial access vectors, distribution methods, threat operators, sales and usage records, victim counts, and follow-on compromises after AI assessments remain unknown. 15. Impact on SOCs and Organizations Correlate browser credential access, Chrome running with --headless, OpenRouter API requests, the presence of Identity_Report.txt, AI_Analysis.txt, and volta_dox.zip, and %APPDATA%\volta_debug.txt on Windows endpoints. If tokens or wallet seeds are stolen, organizations must go beyond changing passwords by revoking sessions and migrating wallet assets. 16. Summary by Role SOC: Correlate browser credential access, OpenRouter API requests, VOLTA artifacts, and ZIP file transmissions in chronological order. Administrators: Use application control to restrict unauthorized processes from launching Chrome with --headless, and prepare credential response procedures covering tokens and wallets. Users: If you suspect an unauthorized file was executed, disconnect the device from the network immediately and report it as a potential information leak involving wallet seeds and sessions.