A self-deleting Windows infostealer that calls itself VOLTA-AUTODOXER steals everything it can from a victim’s PC, then asks an AI model, Anthropic’s Claude by default, to turn the haul into a target assessment, Cisco’s Talos research organization reports. The malware builds a structured “evidence bundle” on the person and asks the model for a list of their valuables ranked by how much they could be cashed out for, to see what’s worth the effort. VOLTA operates with a prompt to act as “a forensic intelligence analyst” and to be “blunt, specific, accurate,” and can switch models if one refuses, or even do without.
VOLTA steals browser passwords, cookies, and saved payment cards, Thunderbird and Outlook email profiles, Roblox accounts, Microsoft OAuth tokens, screenshots, and even SSH and cloud-provider configuration files. Every saved Wi-Fi password gets pulled in plaintext. Cryptocurrency wallets, when present, are not just copied, as the malware attempts to crack their vaults inline. It then builds the evidence bundle on the person: geolocation and home address, employer and employer domain, inferred birth year, document authorship metadata, and the last four digits of their payment cards.
It also engages in live enrichment with any stolen sessions. VOLTA searches the victim’s Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to confirm a home address, pulls Uber Eats and DoorDash order histories, reuses the stolen Discord token to fill in the victim’s profile, and values Roblox items through Rolimons. The theft list is relatively standard for a stealer, but this enrichment pass turns passive data into something dangerous.
The data is first assembled locally as Identity_Report.txt and serialized to JSON, before being POSTed to OpenRouter, a popular model router, with the system prompt. Any reply is saved as AI_Analysis.txt, and both are exfiltrated together in a volta_dox.zip archive file. This inference call happens over the victim’s own network connection. The model call asks for a concise assessment of the victim’s suitability as a target, backed by citations, with “opsec” to analyze overall security posture, including password hygiene.
The settings in use include Anthropic’s Claude Opus 4.6 by default, an older model released in February, at a temperature of 0.2. Temperature controls how random a model’s output is from a baseline 1.0, and the hardcoded low value suggests the operator prioritizes predictability. The author likely anticipates refusals, and VOLTA looks for refusal phrases and thin replies, switching to two other models, Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash, in that order. If the VOLTA user supplies no API key for OpenRouter, it can still send the dossier over Telegram without the AI data.
VOLTA appears to be a product designed for resale, as it has a template with six swappable slots — for a custom Telegram channel, API keys, and settings — that are filled at build time. The customer would supply the values, and a custom binary would be created. While the slot credentials are encrypted, it’s possible to recover them from the file. Assuming everything goes to plan with the delivered build, the customer receives ranked target assessments in their Telegram inbox without relying on any attacker-owned infrastructure; the chokepoints are on the services.
Much of the token theft relies on bypassing Chrome’s App-Bound Encryption (ABE), which VOLTA does by launching Chrome headless, that is, without a GUI. An application-control policy that limits which processes may launch Chrome headless blocks the ABE decryption path. This reduces exposure to VOLTA’s particular method of attack by denying it access to Chrome-stored sessions, but it doesn’t stop its other theft, the AI stage, or exfiltration.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
After infection, the main executable may delete itself, but a volta_debug.txt file should be preserved by the victim. This file is a log that shows what was collected and whether the LLM call was successful. The target should revoke or rotate all API keys and tokens and change passwords, regardless of exposure; likewise, any funds in a wallet whose seed phrase was stored in plaintext should be moved to a new wallet with a fresh seed, preferably generated on an air-gapped device.
One very real concern is that VOLTA’s use of AI is relatively narrow compared with what is possible with fully AI-assisted malware, especially as models could be utilized for additional phases. Refusal resilience may become a standard design requirement for malware as AI integration matures. Already, a Windows malware implant reported in September was built around a panel of up to four LLMs that vote on its next move, and another, reported this week, can fall back to using the victim’s own OpenAI API key. This is still a process of having AI replace the work a human analyst would normally do, so the real question is which stage is next.
4 hours ago
18
English (US) ·