Cisco Talos has identified a Windows infostealer that asks commercial large language models to assess victims’ assets, security habits, and potential financial value. In its October 31, 2026 report, Talos describes VOLTA-AUTODOXER as a self-deleting stealer with an optional LLM-powered profiling layer.
The documented AI role begins after data theft. VOLTA collects passwords, session tokens, cryptocurrency wallet material, and personal information through its conventional malware capabilities. It then packages that evidence for an LLM to analyze on the operator’s behalf.
The findings describe malware capabilities, not a measured campaign. WIRED reports that Talos did not track whether VOLTA had been used in the wild, so the research supplies no deployment scale or victim count.
How VOLTA Turns Stolen Data Into a Target Assessment
VOLTA’s first collection pass reaches across browsers, messaging apps, gaming accounts, email clients, and configuration files. According to Talos, its targets include:
- Browser data: saved passwords, cookies, and payment cards from Chromium-based browsers, alongside Firefox data.
- Account sessions: Discord, Telegram, Steam, Battle.net, and Roblox access.
- Work and infrastructure credentials: Microsoft OAuth tokens, Slack workspaces, SSH material, and cloud-provider configuration files.
- Cryptocurrency assets: wallet material, including an embedded vault-cracking routine.
- Local context: saved Wi-Fi passwords, screenshots, and document metadata.
The collection extends beyond copying files. VOLTA uses stolen authenticated access to gather more information from online accounts. It searches Gmail for purchase receipts, requests Uber Eats and DoorDash order histories, and enriches Discord account details using a stolen token. It also performs a live Roblox inventory valuation.
Those records help construct a personal profile. A delivery address can corroborate someone’s location; document authorship metadata and an employer domain can connect personal and professional identities. Talos says the resulting bundle can include an inferred birth year, card last-four digits, Slack workspaces, and iPhone backup indicators.
Only after that collection and enrichment does the LLM enter the workflow. VOLTA serializes the bundle and sends it through OpenRouter, requesting a structured target assessment. The requested output ranks valuables by monetization potential using low, medium, or high tiers and evaluates password hygiene and security posture. Talos describes this as an intelligence-analysis function built into the stealer.
My reading is that the useful change for the attacker is sorting power. A raw credential dump leaves an operator to work out which accounts matter, how records connect, and which opportunities deserve immediate attention. VOLTA attempts to automate that judgment.
The requested citations need careful interpretation, though. They can connect a model’s conclusions to items in the stolen bundle; they do not independently verify an inferred identity, asset valuation, or password pattern.
Three Configured Models and a Refusal Check
VOLTA routes its analysis requests through OpenRouter’s chat-completions API. Talos documented this configuration:
| Setting | Value found by Talos |
|---|---|
| API endpoint | https://openrouter.ai/api/v1/chat/completions |
| Default model | anthropic/claude-opus-4.6 |
| First fallback | moonshotai/kimi-k2 |
| Second fallback | google/gemini-2.5-flash |
| Temperature | 0.2 |
| Request construction | Hand-assembled JSON, without an SDK |
The malware checks responses for refusal language, including “I can’t” and “I’m not able,” before moving through the fallback chain. That logic shows the developer anticipated safety refusals and built a way to try another model.
The configuration does not prove every listed endpoint successfully processed stolen data. It also provides no basis for claiming that OpenRouter or the named model providers knowingly supported the malware.
The low temperature setting reduces sampling variability, suggesting a preference for consistent assessments. It cannot guarantee accurate conclusions or identical responses.
From a defensive perspective, the fallback logic matters more than the choice of any single model. A refusal from one endpoint is not necessarily the end of the analysis attempt. The malware can try another provider’s model, and its underlying theft capabilities remain available even if the AI layer fails. Talos’s configuration analysis supports that distinction between collecting data and subsequently interpreting it.
I would treat model safeguards as one interruption point, not as containment for this malware. By the time the model receives a request, credentials and sessions have already been collected.
What Defenders Can Look For
Talos’s findings provide several concrete artifacts for investigation. Their value varies: a VOLTA-specific file is much more distinctive than traffic to a widely used API.
| Artifact | Investigative value | Important caveat |
|---|---|---|
%APPDATA%\volta_debug.txt | Harvest log to preserve when available | Absence alone cannot rule out compromise |
| OpenRouter chat-completions endpoint | Destination and request path used by the AI stage | Legitimate applications use the same service |
| The three configured model identifiers | Clues in recovered configuration or request bodies | Network monitoring may not expose request contents |
WALLET VAULTS CRACKED | Report marker associated with the wallet-cracking routine | A string match needs surrounding context |
Talos’s recommendation to preserve the harvest log is particularly useful because VOLTA is self-deleting. Where the file survives, it can help investigators understand the collection activity after the executable is gone. See the primary report for the published findings.
An OpenRouter connection by itself is weak evidence. A stronger investigation would connect the destination to a suspicious process, relevant file activity, recovered configuration, or the harvest log. Request paths and model names are useful only where telemetry actually exposes them.
The same caution applies to blocking. Restricting unapproved LLM API access may interrupt this analysis stage in a managed environment, but it cannot undo credential collection or account access that happened earlier. Broadly blocking a legitimate service also carries costs for authorized applications.
Revoke Sessions, Reset Credentials, and Preserve Evidence
Talos recommends three concrete response actions: revoke potentially compromised tokens, change passwords, and preserve the harvest log when available.
The token step deserves equal billing with password changes. VOLTA collects existing authenticated sessions and uses some of them to retrieve more data. A password reset and a session revocation are different controls; responders should check how each affected service handles existing sessions and connected applications.
Frequently Asked Questions
3 questions
1Does VOLTA Use AI to Break Into Computers?
The documented LLM stage happens after credential theft and data enrichment. Talos describes AI-assisted victim analysis, not an LLM performing the initial compromise.
