VOLTA infostealer uses hosted LLMs to rank victims by payout

Cisco Talos has documented VOLTA (which it also calls VOLTA-AUTODOXER), a Windows infostealer that does something most stealers don't: after it harvests a machine, it sends the stolen profile to a commercial large language model and asks the model to rank the victim by how much money they're worth. The analysis is written back in plain English — a "target assessment" the operator reads before deciding what to monetize first.

Talos researcher Ryan Fetterman published the writeup on October 31, 2026. The primary source is the Talos Intelligence blog; it is the only detailed account so far, corroborated by reporting at The Hacker News.

What it steals

VOLTA runs on Windows and collects the usual stealer haul, then goes further:

• Passwords and cookies from Chromium-based browsers, plus payment cards.
• Cryptocurrency wallet seed phrases.
• Discord, Telegram, Steam, and Roblox sessions.
• Microsoft OAuth tokens, SSH keys, and cloud-provider keys.
• Wi-Fi profiles and screenshots.

It then builds a dossier — location and inferred home address, employer and employer domain, card last-4 digits, a Roblox account valuation — and uses the stolen sessions to enrich it live: VOLTA searches the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to corroborate the home address and spending.

The AI step

VOLTA assembles the dossier into Identity_Report.txt and POSTs it to OpenRouter, a unified LLM API gateway, at hxxps://openrouter[.]ai/api/v1/chat/completions. Per Talos, the request chain is:

• Default model: anthropic/claude-opus-4.6
• Fallback: moonshotai/kimi-k2
• Fallback: google/gemini-2.5-flash
• Temperature: 0.2

Each response is scanned for refusal phrases ("I can't," "I'm not able"); on a refusal, the request falls through to the next model, up to three. The ~240-word system prompt casts the model as a "forensic intelligence analyst" and requires two output sections: "WHAT THEY'RE WORTH" (valuables ranked low/medium/high by monetization) and "THEIR OPSEC" (an assessment of the victim's security posture and password hygiene). The model returns AI_Analysis.txt.

Exfiltration

The stealer packages its output into zip archives — volta_log.zip, volta_dox.zip, volta_doxnet.zip — and exfiltrates in three stages: raw stolen data first, the AI analysis second, and the live Gmail-receipt enrichment last. Talos notes the sample is built from a template with six configuration slots (Telegram channel, API keys, and other settings), which suggests the author may sell a builder kit or compile a bespoke binary per order.

Detection

Talos published a hash and filenames, not YARA or Sigma. Copied verbatim from the Talos report:

SHA256:    57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
Filenames: 9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe
Type:      PE32+ x86-64
PE timestamp:  2026-08-17 20:35
First seen:    2026-10-11 12:46 (UTC)

Talos says VOLTA uses no actor-owned infrastructure — every observed endpoint (OpenRouter, Telegram) is a legitimate third-party service, so network blocklists won't catch it. Defenders should preserve %APPDATA%\volta_debug.txt, a harvest log VOLTA leaves on disk.

Action checklist

1. Hunt for the SHA256 and filenames above across your EDR fleet; preserve %APPDATA%\volta_debug.txt on any hit.
2. Watch for process-initiated outbound requests to openrouter.ai/api/v1/chat/completions from non-developer endpoints — a stealer calling a public LLM gateway is anomalous traffic, not blockable by reputation.
3. Treat any confirmed hit as a full session compromise: rotate browser-stored passwords, Microsoft OAuth tokens, SSH keys, and cloud keys, and revoke active Discord/Telegram/Steam sessions.
4. If crypto wallets were present on the host, assume seed phrases are gone and move funds from a clean device.

Context

VOLTA is the latest sign that malware authors now treat hosted LLMs as infrastructure rather than a research curiosity. The twist here is economic: the model isn't exploited or jailbroken into writing code — it's used as a paid triage analyst that turns a raw credential dump into a ranked monetization plan, and the refusal-handling fallback chain exists precisely to route around any one provider's guardrails. It is the inverse of a case we covered earlier this year, macOS.Gaslight, where a DPRK implant carried a prompt-injection payload built to sabotage an AI malware-triage agent. In both, the commercial model is a component in the operation — defender tooling in one direction, victim-appraisal engine in the other.