Steal, Then Ask Claude to Appraise the Loot: Talos Details VOLTA, an Infostealer That Ranks Every Victim by Worth

Cisco Talos has published an analysis of VOLTA-AUTODOXER, a self-deleting Windows infostealer that adds an unusual twist to a familiar recipe: after harvesting a victim's data, it hands the pile to a large language model and asks it to write a target assessment ranking what that person is worth. The report, written by researcher Ryan Fetterman and dated October 31, describes the malware as "a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work."

The collection phase is extensive. VOLTA takes browser passwords, cookies and saved payment cards from Chromium-based browsers plus Firefox, Thunderbird and Outlook data, Microsoft OAuth tokens, SSH and cloud configuration files, VPN settings, every saved Wi-Fi password, and sessions from Slack, Steam, Battle.net, Discord, Telegram and Roblox. It also grabs cryptocurrency seed phrases and runs an embedded cracker against the wallet vault rather than simply copying the file. Much of the token theft depends on launching Chrome with the --headless flag to bypass the browser's App-Bound Encryption, and Talos suggests an app-control policy restricting which processes can launch Chrome that way.

Then comes the enrichment pass that separates VOLTA from commodity stealers: it reuses stolen sessions to search the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls delivery order histories, and queries Rolimons for a live valuation of the victim's Roblox inventory. The results are compiled into an Identity_Report.txt, serialized as JSON and posted to OpenRouter, the commercial routing service that exposes many models behind one API.

The system prompt tells the model to act as "a forensic intelligence analyst drafting a target assessment." The required output includes a section headed "WHAT THEY'RE WORTH" that ranks valuables by how easily they can be monetized, and a "THEIR OPSEC" section assessing the victim's security habits. The hardcoded default is anthropic/claude-opus-4.6; if the reply contains refusal phrases such as "I can't" or "I'm not able," the malware moves on to moonshotai/kimi-k2 and then google/gemini-2.5-flash. The sampling temperature is fixed at 0.2, which Talos reads as a preference for repeatable output.

"They're building in the expectation to potentially hit model refusals at first request," Fetterman told Wired, which covered the finding the same day. The design treats a refusal as a routing problem rather than a stop — a detail that matters for model providers, because vendor-level safety settings are not a barrier when the operator simply budgets for refusals and configures a chain. Notably, the inference request leaves the infected machine as ordinary-looking traffic to a legitimate API before any data is exfiltrated, and every observed endpoint belongs to a third party, so there is no attacker-owned server to seize. If no API key is present, VOLTA still works as a conventional stealer.

Talos assesses that the malware is likely sold to customers: the builder carries six swappable template slots filled at build time, with credentials weakly encrypted using constants from the binary. Stolen files leave in up to three stages, named volta_log.zip, volta_dox.zip and volta_doxnet.zip. The analyzed binary carries a PE timestamp of August 17, 2026 and was first seen on October 11, but Talos did not track whether VOLTA has been used in the wild, lists no victim count and offers no evidence of an active campaign.

The caveats are worth restating: this rests on one vendor's analysis of one sample, and Anthropic, Moonshot AI, Google and OpenRouter have not commented. But the pattern it documents — attackers repurposing commercial AI infrastructure at the key holder's expense — echoes recent findings such as CrowdStrike's ARTEX framework and underground sales of AI attack panels running on stolen API keys. For any organization storing frontier model credentials on developer machines or in build pipelines, VOLTA is one more argument for treating those keys like banking passwords.