Cisco Talos has analyzed a Windows infostealer that steals credentials, sessions and cryptocurrency wallet data, then optionally asks commercial AI models to assess the person behind the machine. Called VOLTA-AUTODOXER, the malware uses OpenRouter to route its victim-profiling request through Claude Opus 4.6, with fallbacks to Kimi K2 and Gemini 2.5 Flash.
In its October 31, 2026 analysis, Talos describes a self-deleting stealer with a broad collection capability and an additional LLM-powered appraisal layer. The model’s assigned job is to identify valuable assets and assess the victim’s security posture after the theft.
The scope of the discovery matters. VOLTA surfaced through Talos’s CAIRN research effort, and researcher Ryan Fetterman told WIRED that Talos had not tracked whether it had been used in the wild. The published findings provide evidence of the malware’s design, without establishing widespread deployment or a victim count.
For defenders, the most useful distinction is where AI enters the process: the theft happens first. Preventing the subsequent model request can interrupt automated profiling, but the credentials and sessions still need an incident response.
VOLTA Collects Credentials Before Calling a Model
Talos describes VOLTA as a mature stealer with an optional AI integration. Its collection targets span everyday accounts, workplace access and financial assets.
The documented capabilities include:
- Browser data: Saved passwords, cookies and payment cards across Chromium-based browsers, alongside Firefox data.
- Account access: Microsoft OAuth tokens, Discord tokens, Telegram sessions, Steam and Battle.net sessions, and Roblox accounts.
- Work and infrastructure data: Outlook profiles, Thunderbird data, Slack workspaces, SSH material, and cloud-provider or VPN configuration files.
- Financial and local information: Cryptocurrency wallets and seed phrases, saved Wi-Fi passwords, screenshots and other identifying records.
These categories create different recovery problems. A stolen password can support a future login; a stolen session token or cookie may let an attacker reuse an existing authenticated session. Changing a password therefore needs to be paired with the relevant service’s session and token controls.
Talos also reports that VOLTA attempts to crack cryptocurrency wallet vaults during collection and records the outcome in its own report. The presence of that capability should not be read as proof that every protected wallet can be opened.
The collection breadth is consequential on its own. A personal Windows computer can hold gaming accounts, payment details, work sessions and infrastructure credentials simultaneously. VOLTA’s AI layer receives the results of that collection; it is not required to obtain them.
Stolen Sessions Become a Personal Dossier
VOLTA uses some stolen access immediately to enrich its findings. According to Talos, it searches Gmail for purchase receipts using the victim’s authenticated tokens, queries Uber Eats and DoorDash order history, and uses a stolen Discord token to enrich the account profile.
The resulting evidence bundle can include a home address, geolocation, employer and employer domain, inferred birth year, payment-card last-four digits, Slack workspaces, document authorship metadata and iPhone backup indicators. Talos also describes a live valuation lookup for Roblox inventory. Its analysis documents how these details feed the later assessment.
That sequence explains why a delivery receipt can matter in a credential-theft incident. A receipt can connect an email account to a physical address. Employer information can connect a personal identity to workplace access. An inventory lookup can assign potential value to a gaming account.
My view is that this enrichment stage deserves as much defensive attention as the model call. The underlying accounts supply the evidence that makes the assessment useful. Revoking access quickly can limit further authenticated queries, although it cannot retrieve information already copied.
The privacy impact also extends beyond login recovery. A password can be replaced; an established link between someone’s identity, address and employer is harder to undo.
How the Claude, Kimi and Gemini Fallback Works
VOLTA serializes its evidence bundle and sends it to OpenRouter’s chat-completions endpoint. The embedded system prompt tells the model to act as “a forensic intelligence analyst drafting a target assessment.”
The requested output includes a ranked assessment of valuables, low-, medium- or high-value tiers, and an evaluation of the victim’s security posture and password hygiene. It also asks the model to connect details across the evidence, such as identifying relationships between personal information and password patterns.
Talos found this hardcoded routing configuration:
| Order | Model route | Configured role |
|---|---|---|
| 1 | anthropic/claude-opus-4.6 | Default assessment model |
| 2 | moonshotai/kimi-k2 | First fallback |
| 3 | google/gemini-2.5-flash | Second fallback |
The malware checks responses for refusal language, including “I can’t”, before moving down the chain. Talos describes the cascading behavior as an engineering choice that anticipates model refusals or failures. Requests use hand-assembled JSON and a temperature setting of 0.2. The configuration is documented in Talos’s report.
A low temperature generally reduces output variability. It cannot guarantee that a model’s deductions are accurate. Likewise, requesting citations to the supplied evidence gives an assessment a traceable structure, but an inferred relationship between a password and a person’s background can still be wrong.
The model identifiers show intended routing. They are not evidence of endorsement by Anthropic, Moonshot AI or Google, nor proof that every configured service processed a request successfully.
I’d treat the refusal handling as the most important AI-specific detail. VOLTA makes rejection a condition for trying another provider. The published analysis supports that architectural observation; it supplies no measured success rate for defeating the models’ safeguards.
The Security Consequence: Faster Decisions After Theft
VOLTA gives the model a sorting task that follows a conventional compromise. An operator receiving a large credential dump would otherwise need to inspect its contents, identify useful access and decide what to pursue first. The requested assessment is designed to organize that work.
Fetterman told WIRED that identifying high-value targets faster could improve an attacker’s opportunity to use credentials or tokens before they expire or are changed. That is a plausible operational advantage, not a measured improvement demonstrated by this research.
Three documented details lead to a practical conclusion:
- Collection and enrichment happen before the LLM assessment. Sensitive data has already been gathered when the request is prepared.
- The stealer can operate without AI. Blocking access to a model leaves the core collection capability intact.
- The request can move between models. One provider’s refusal may trigger another attempt.
Consequently, an AI-service alert should trigger investigation into an earlier compromise. Treating the model request as the beginning of the incident would miss the collection stage that supplied its contents.
The fallback chain is also a pattern worth watching across the AI industry. If reused in other crimeware, it could spread related requests across providers with different visibility and controls. That is an implication of the design, not a claim that Talos observed such a broader campaign.
Frequently Asked Questions
3 questions
1Does VOLTA Need AI to Steal Credentials?
No. Talos describes the LLM integration as optional. VOLTA’s core collection capabilities remain functional without a model assessment.
