VOLTA Windows infostealer uses LLMs to rank stolen victim data
November 5: Talos adds model failover, email receipt searches via stolen sessions, a claimed Chrome App-Bound Encryption bypass, and defensive advice.
Cisco Talos describes VOLTA, a self-deleting Windows infostealer that ranks stolen data with LLMs and sends staged ZIPs to Telegram.
Cisco Talos reports VOLTA-AUTODOXER, a Windows infostealer that collects browser data, sessions, Wi-Fi passwords, credentials, and cryptocurrency wallets, then deletes itself. It sends a structured bundle to a large language model, defaulting to Anthropic Claude Opus 4.6 and failing over if a model refuses, to rank assets as low, medium, or high worth and assess operational security. Stolen sessions are used to search victim email for purchase receipts. Data goes out in staged ZIP archives, up to three files, to a Telegram channel. Talos says VOLTA can bypass Chrome’s App-Bound Encryption and advises alerting on headless Chrome launches, revoking tokens, and treating plaintext wallet seeds as compromised.
- Targets Windows; steals browser data, sessions, Wi-Fi passwords, and crypto wallets.
- Defaults to Anthropic Claude Opus 4.6 and fails over if a model refuses.
- Ranks assets low, medium, or high and assesses operational security.
- Exfiltrates staged ZIP archives, up to three files, via Telegram.
- Talos says it can bypass Chrome App-Bound Encryption, then deletes itself.
Timeline
dated events in the reporting · oldest first- Nov 2, 2026Security Affairs reports Talos findings on VOLTA-AUTODOXER. · Security Affairs
- Nov 5, 2026Talos newsletter details VOLTA behavior and defensive advice. · Cisco Talos
What each outlet adds
beyond the shared facts- Security AffairsNames Claude Opus 4.6 default and up to three ZIP files.
- Cisco TalosAdds model failover, email receipt search, Chrome encryption bypass, and response advice.
- Vendors
- Cisco TalosGoogle
- Products
- Chrome
- Malware
- VOLTA
- Organizations
- TalosCisco TalosRailway
- Countries
- Germany
Coverage
oldest first · one row per article · UTC- · 6d ago
Security AffairsFirst report
VOLTA infostealer uses AI to rank victims by value
The malware deletes itself after collecting data and forwards AI-ranked victim profiles via Telegram.
- · 3d ago
Cisco Talos
Talos details VOLTA, a Windows infostealer that ranks loot with LLMs
The same newsletter repeats claims about Railway agents, freezer attacks in 10 countries, and a Binance theft.