VOLTA infostealer uses LLMs to rank victims by monetization value
Original title: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
The self-deleting Windows stealer posts a structured dossier to OpenRouter and fails over across three models if one refuses.
Cisco Talos describes VOLTA-AUTODOXER, a self-deleting Windows infostealer found through its CAIRN effort. After stealing browser credentials, sessions, cards, wallets, tokens, and Wi-Fi passwords, it enriches the haul with the victim’s own accounts and sends a bundle to an LLM for a monetization and security-posture assessment. The default model is anthropic/claude-opus-4.6, with failover to moonshotai/kimi-k2 and then google/gemini-2.5-flash. Talos says the implant has no attacker-owned infrastructure and still works if the AI calls fail.
Unconfirmed: Talos does not state whether VOLTA has been observed in real infections.
- Default calls go to OpenRouter’s chat completions API at temperature 0.2.
- Refusals are detected from phrases such as “I can’t” before the next model.
- Collection includes Discord, Telegram, Steam, Roblox, Microsoft OAuth, SSH, and cloud keys.
- An embedded cracker targets cryptocurrency vaults and logs cracked results.
- Stolen Gmail, delivery, and Discord sessions are reused to enrich the dossier.
Impact: Stolen credentials, sessions, wallets, and personal data ranked for sale
- ATT&CK
- T1555.003 Credentials from Web BrowsersT1539 Steal Web Session CookieT1552.001 Credentials In Files
- Malware
- VOLTAVOLTA-AUTODOXER
- Organizations
- Cisco TalosOpenRouter
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | rolimons.com | m's account profile. Roblox inventory is valued via a live “Rolimons[.]com” lookup. Figure 7. That’s right: Your Uber Eats history i |
| sha256 | 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 | net and a wide net that sorts itself. Sample details SHA256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 Filename 9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe Type PE32+ x86 |
From the original article
7 min read at blog.talosintelligence.com
The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.
By Ryan Fetterman · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.