Which model does the VOLTA infostealer use to profile victims?

VOLTA-AUTODOXER calls OpenRouter and asks for anthropic/claude-opus-4.6 by default, at a temperature of 0.2 for consistent output. When a reply contains a refusal phrase, the malware moves down a fallback chain to moonshotai/kimi-k2 and then google/gemini-2.5-flash, up to three models in all. Talos reads that design as the author expecting refusals and planning around them.

How is VOLTA-AUTODOXER different from a normal credential stealer?

Ranking is the difference. Ordinary stealers dump everything and leave triage to the operator, while VOLTA-AUTODOXER sends a structured evidence bundle to a language model that sorts the victim's valuables into low, medium and high tiers and assesses their security habits. Talos also documents enrichment before that call, such as searching a victim's Gmail for receipts to confirm a home address.

What should a defender check after a suspected VOLTA infection?

Preserve the volta_debug.txt harvest log in the user's roaming application data folder, because Talos says the file records what the malware collected and whether the model call succeeded. Review which browser profiles existed on the host, revoke tokens and change passwords for every account with a stored session, and treat a wallet as compromised if its seed phrase was saved in plaintext.

MEDIncident

VOLTA-AUTODOXER: a stealer asks an LLM which victims are worth most

A Windows stealer now pays a language model to say which stolen accounts and wallets its operator should chase first.

October 31, 2026 · Cisco Talos · Research by Ryan Fetterman

Windows

Title card for the Cisco Talos report on the VOLTA infostealer

MEDIncident

VOLTA-AUTODOXER, a Windows infostealer tracked by Cisco Talos, sends the data it steals to a hosted language model that ranks the victim's assets by resale value and rates their password habits.

01What happened

Cisco Talos published its analysis of VOLTA-AUTODOXER on October 31, 2026, written by researcher Ryan Fetterman. Talos first saw the sample, a self-deleting 64-bit Windows binary, on October 11, 2026. Six swappable template slots filled at build time point to a builder sold to customers rather than one operator's private tool.

02How it works

After harvesting credentials, sessions and crypto wallets, the stealer writes an Identity_Report.txt holding geolocation, employer, inferred birth year, partial card numbers and Roblox account value. The malware enriches that file by reusing stolen sessions, searching Gmail for purchase receipts to confirm a home address, reading food delivery order history and valuing Roblox inventory through a live lookup. The bundle then goes to OpenRouter under a system prompt casting the model as a forensic intelligence analyst drafting a target assessment, which must return a low, medium and high ranking of valuables plus a judgement on the victim's password hygiene and security posture. The reply is saved as AI_Analysis.txt and shipped out inside volta_dox.zip.

03Who is affected

Windows users who run the stealer are exposed, along with any account whose session cookie, password or wallet file sat on that machine. The App-Bound Encryption bypass path works by launching Chrome with the --headless flag, so Chrome profiles on an infected host are in scope. Talos reports that every endpoint the malware touches is a third-party service, with no attacker-owned infrastructure.

04What to do

Use application control to restrict which processes may launch Chrome with --headless, and alert when headless Chrome starts from an unexpected parent process. Keep credentials in hardware-backed stores. After a suspected infection, preserve the harvest log, revoke exposed tokens, change passwords, and move funds from any wallet whose seed phrase sat in plaintext to a new wallet generated on an air-gapped device.

Questions people ask

Which model does the VOLTA infostealer use to profile victims?: VOLTA-AUTODOXER calls OpenRouter and asks for anthropic/claude-opus-4.6 by default, at a temperature of 0.2 for consistent output. When a reply contains a refusal phrase, the malware moves down a fallback chain to moonshotai/kimi-k2 and then google/gemini-2.5-flash, up to three models in all. Talos reads that design as the author expecting refusals and planning around them.
How is VOLTA-AUTODOXER different from a normal credential stealer?: Ranking is the difference. Ordinary stealers dump everything and leave triage to the operator, while VOLTA-AUTODOXER sends a structured evidence bundle to a language model that sorts the victim's valuables into low, medium and high tiers and assesses their security habits. Talos also documents enrichment before that call, such as searching a victim's Gmail for receipts to confirm a home address.
What should a defender check after a suspected VOLTA infection?: Preserve the volta_debug.txt harvest log in the user's roaming application data folder, because Talos says the file records what the malware collected and whether the model call succeeded. Review which browser profiles existed on the host, revoke tokens and change passwords for every account with a stored session, and treat a wallet as compromised if its seed phrase was saved in plaintext.

Sources 3 links, all fetched

1blog.talosintelligence.comTalos Analysis
2blog.talosintelligence.comCAIRN AI Malware Watch
3blog.talosintelligence.comCLOSEDQUORUM Implant