VOLTA Infostealer Asks AI to Price Its Victims, With a Three-Model Chain to Get Past Refusals

What happened

The sample calls itself VOLTA-AUTODOXER and was first seen on Oct 11, 2026 at 12:46 UTC, surfacing through Talos's CAIRN research effort. CAIRN, released and open-sourced by Talos on Sept 22, 2026, hunts, classifies and tracks AI-integrated malware through metadata artifacts such as embedded prompts, provider endpoints and API keys, without downloading or executing the underlying binaries. Talos called VOLTA a mature stealer implant with an optional AI-integration layer, and said it deletes itself after running.

The theft covers most records of modern digital life: credentials, cookies and saved payment cards from Chromium-based browsers, Firefox and Thunderbird, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord and Telegram session tokens, Roblox accounts, Microsoft OAuth tokens, SSH and cloud-provider configuration files, saved Wi-Fi passwords dumped to plaintext, and desktop screenshots; an embedded cracker is also run against wallet vaults found on disk, with the result written into its report. An enrichment pass follows: stolen sessions are used to search Gmail for purchase receipts to corroborate a home address, pull food-delivery order history, enrich Discord account profiles with the stolen token, and value Roblox inventory through a live lookup.

The evidence bundle is assembled locally as Identity_Report.txt, serialized to JSON and POSTed through OpenRouter to a model, with a system prompt instructing the model to act as 'a forensic intelligence analyst drafting a target assessment'; the required output includes a 'WHAT THEY'RE WORTH' section ranking valuables by monetization value in low, medium and high tiers and a 'THEIR OPSEC' section assessing the victim's security posture and password hygiene, and the returned payload is saved as AI_Analysis.txt and exfiltrated together with the bundle. The model call runs over the victim's own network connection, on their own machine, before exfiltration. The default model is anthropic/claude-opus-4.6 at a fixed temperature of 0.2; if a reply contains refusal phrases such as 'I can't' or 'I'm not able', it falls back to moonshotai/kimi-k2 and then google/gemini-2.5-flash; with no API key configured, the AI stage is skipped and the stealing functions still run.

Key facts

1. Publisher and date: Cisco Talos researcher Ryan Fetterman, publishing the analysis on Oct 31, 2026
2. Sample: a Windows infostealer calling itself VOLTA-AUTODOXER, first seen Oct 11, 2026 at 12:46 UTC, self-deleting after it runs
3. Discovery channel: Talos's CAIRN research effort, released and open-sourced Sept 22, 2026, tracking AI-integrated malware through metadata artifacts
4. AI stage: the Identity_Report.txt evidence bundle is sent via OpenRouter to a model, with the AI_Analysis.txt output required to include asset monetization ranking and a security-habit assessment
5. Model chain: default anthropic/claude-opus-4.6 at temperature 0.2, falling back on detected refusal phrasing to moonshotai/kimi-k2 and then google/gemini-2.5-flash
6. Limits and countermeasure: Talos did not track whether VOLTA has been used in real attacks; with no API key the AI stage is skipped; Talos recommends restricting unknown processes from launching Chrome in headless mode