VOLTA Malware Steals Gmail and Discord Sessions Using AI to Build Victim Profiles
Original title: VOLTA Malware Steals Gmail and Discord Sessions, Then Uses AI to Build Detailed Victim Profiles
The VOLTA-AUTODOXER infostealer steals sessions and uses OpenRouter AI to draft forensic victim profiles ranking valuables and opsec.
VOLTA is a new Windows infostealer that pulls passwords, cookies, tokens, and files from multiple browsers and apps including Gmail, Discord, Uber Eats, and Roblox. It uses stolen sessions to access inboxes and order histories, then sends data to OpenRouter AI with instructions to produce Identity_Report.txt and AI_Analysis.txt in volta_dox.zip. Cisco Talos detected it through their CAIRN research and noted it as a builder-style tool sold with custom Telegram reporting. No known exploitation in the wild.
Unconfirmed: Talos did not track whether VOLTA has been used in the wild
- Saves data to Identity_Report.txt and AI_Analysis.txt
- Defaults to Claude Opus 4.6 model via OpenRouter
- Deletes itself after running
- Sold as builder with Telegram channel
- IoC: SHA-256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
Impact: steals victim sessions and builds AI-generated profiles ranking valuables and opsec
- 1.revoke stolen tokens and reset passwords from clean device
- 2.move crypto funds to new wallet if seed phrase was stored in plain text
- 3.monitor %APPDATA%\volta_debug.txt log file
- Vendors
- Cisco Talos
- Malware
- VOLTA
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | openrouter.ai | st Seen (UTC) 2026-10-11 12:46 First sighting URL https[:]//openrouter[.]ai/api/v1/chat/completions AI endpoint (third-party service) |
| domain | rolimons.com | olta_dox.zip; volta_doxnet.zip Exfiltration packages Domain Rolimons[.]com Roblox value lookup Note: IP addresses and domains are in |
| sha256 | 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 | s of compromise (IoCs):- Type Indicator Description SHA-256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 VOLTA sample (PE32+ x86-64) Filename 9BY0tjwOc3ut.exe / yLP |
From the original article
4 min read at cybersecuritynews.com
A new Windows infostealer called VOLTA does more than steal passwords. After it grabs Gmail, Discord and other logins, it asks an AI model to study the loot and write a report on how much the victim is worth. The idea is simple: steal everything, then let AI sort it out.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.