A new Windows infostealer does not stop at grabbing passwords, cookies and crypto wallets. Once it has them, it hands a dossier on the victim to a large language model and asks it to rank what that person is worth. Cisco Talos researcher Ryan Fetterman detailed the malware, which names itself VOLTA-AUTODOXER and surfaced through Talos's CAIRN research effort.
The point, Talos argues, is not speed or scale. It is effort displacement: the slow human job of sifting a stolen credential log for the valuable parts is replaced with a single model call.
Gmail receipts to confirm a home address
VOLTA's haul is broad. It takes browser passwords, cookies and saved payment cards from Chromium-based browsers, Firefox and Thunderbird data, Outlook profiles, Slack workspaces, Discord tokens, Telegram, Steam, Battle.net and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider configuration files, and every saved Wi-Fi password on the machine in plaintext. It also runs an embedded cracker against cryptocurrency wallet vaults on the spot.
Then it uses the stolen sessions to dig further. With the victim's own Gmail tokens it searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls Uber Eats and DoorDash order history directly, re-uses the Discord token to enrich the profile, and values the victim's Roblox inventory through a live lookup. The result is written locally to a file called Identity_Report.txt.
A model told to play forensic analyst
That report is sent as JSON to OpenRouter, a service that routes requests to many AI models, under a system prompt telling the model to act as "a forensic intelligence analyst drafting a target assessment." The required output includes a section headed "WHAT THEY'RE WORTH," ranking valuables in low, medium and high monetization tiers, and one on "THEIR OPSEC," judging the victim's security posture and password hygiene. The prompt also encourages the model to connect sparse details, such as names, addresses or universities, to patterns in the victim's passwords.
The default model is hardcoded as Anthropic's Claude Opus 4.6. If a reply contains refusal phrases such as "I can't," VOLTA falls back to Moonshot AI's Kimi K2 and then Google's Gemini 2.5 Flash, all at a low temperature of 0.2 for consistent output. Talos reads that chain as evidence the author expected to hit model guardrails. The stealer can also run without the AI stage entirely if no key is configured.
Built to be sold, not just used
VOLTA's settings, including its Telegram channel and API keys, live in six swappable slots filled at build time, which Talos takes as the mark of a builder sold to customers. The credentials in those slots are encrypted with a key derived from constants in the same binary, so anyone who reverses a sample can recover them. The malware deletes itself after running, and every endpoint Talos observed is third-party controlled, with no attacker-owned infrastructure.
Block headless Chrome and keep the debug log
Much of VOLTA's token theft depends on bypassing Chrome's App-Bound Encryption. Talos recommends an application control policy restricting which processes may launch Chrome with --headless, which would block that decryption path, or at minimum alerting when headless Chrome is launched by anything other than known developer tooling. After an infection, preserve %APPDATA%\volta_debug.txt, a timestamped log of what was taken and whether the AI call succeeded, then revoke tokens and change passwords. Any wallet whose seed phrase sat in plaintext on disk should be treated as fully compromised, with funds moved to a new wallet whose seed was generated on an air-gapped device.
Indicator (SHA256): 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
IntelFusions has recently covered a stealer that raids AI app credentials and a RAT that bills its AI queries to the victim. VOLTA flips the relationship. The AI is no longer the loot or the tool; it is the analyst deciding which victim gets worked first.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.