VOLTA infostealer: Talos says it asks Claude Opus 4.6 via OpenRouter what victims are worth

Cisco Talos published an analysis on 31 October 2026 of VOLTA-AUTODOXER, a Windows infostealer that, after stealing a victim's data, sends a summary of it to a large language model and asks for a "target assessment" of what the person is worth. Talos says the malware calls Anthropic's Claude Opus 4.6 through the OpenRouter service by default, and moves to two other models if the first one refuses. The finding matters less for the theft, which is conventional, than for what it shows: criminals are using commercial AI models as a cheap analyst for sorting stolen data, and they are writing their malware to cope with model refusals.

Key points

• Talos says VOLTA is a self-deleting Windows infostealer with an optional AI layer that ranks what a victim's stolen data is worth.
• The AI stage uses the OpenRouter chat completions API, with anthropic/claude-opus-4.6 as the default model, then moonshotai/kimi-k2, then google/gemini-2.5-flash if a model refuses.
• Talos reports the sample was first seen on 11 October 2026 (12:46 UTC); its PE compile timestamp is 17 August 2026.
• Talos says it found no attacker-owned infrastructure; every endpoint it saw is third-party controlled, and it did not say how many people were infected.
• The AI step is optional: without an API key the malware still steals data and skips the dossier.

What to do

• Who is at risk: Windows users who ran an untrusted executable. Talos lists browsers (Chromium and Firefox), Thunderbird, Outlook, Slack, Steam, Battle.net, Discord, Telegram, Roblox, SSH keys, cloud-provider configuration, cryptocurrency wallet seed phrases, Microsoft OAuth tokens and saved Wi-Fi passwords among the targets.
• How to check: Talos suggests preserving volta_debug.txt from the AppData directory if you find it, because it logs what was collected and whether the AI call succeeded. Other file names Talos lists are Identity_Report.txt, AI_Analysis.txt, volta_log.zip, volta_dox.zip and volta_doxnet.zip. The SHA-256 of the analysed sample is 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.
• If you think you were hit: revoke tokens and sessions, change passwords from a clean device, and if a wallet seed phrase was stored in plain text, move funds to a new wallet whose seed was generated on an air-gapped device. That is Talos's advice.
• For defenders: Talos recommends application control that limits which processes can launch Chrome with --headless (the route it describes for bypassing Chrome's App-Bound Encryption), alerting on headless Chrome started by unknown processes, and storing credentials in hardware-backed stores.

What happened

Talos found VOLTA through CAIRN, a research effort it says it released and open-sourced on 22 September 2026 to track AI-integrated malware through artefacts such as embedded prompts, provider endpoints and API keys. Its report, written by researcher Ryan Fetterman according to a secondary write-up, describes a "mature stealer implant with an optional AI-integration layer."

The theft part is wide. According to Talos, the malware collects browser passwords, cookies and saved payment cards, mail and chat data, gaming accounts, SSH and cloud configuration, wallet seed phrases, Microsoft OAuth tokens, saved Wi-Fi profiles (using the Windows WlanGetProfileList call and dumping the passwords in plain text) and screenshots. It also runs an embedded cracker against wallet vaults and reports the results on a "WALLET VAULTS CRACKED" line.

It then enriches the picture. Using stolen sessions, Talos says, it searches the victim's Gmail for receipts from retailers and delivery services to confirm a home address, pulls Uber Eats and DoorDash order history, reuses Discord tokens, and values a Roblox inventory through a live lookup on Rolimons. The results go into a file called Identity_Report.txt.

That file is what the AI step reads. The malware sends the structured evidence to OpenRouter. The system prompt, per Talos, casts the model as a forensic intelligence analyst writing a target assessment. Required sections include "WHAT THEY'RE WORTH", which ranks the victim's valuables by how easily they can be monetised (low, medium, high), and "THEIR OPSEC", which judges security posture and password habits. The prompt also asks the model to infer links across sparse data, for example tying names, addresses or schools to likely password patterns. The answer is saved as AI_Analysis.txt and the lot is packed into volta_dox.zip.

Background

Infostealers are not new, and neither is sorting their output. Stolen "logs" are traded in bulk, and buyers have long searched them for the valuable ones by hand or with scripts. What is new here is that the sorting is delegated to a general-purpose model at the moment of infection, in the attacker's own tooling.

VOLTA is not the only case of this idea. Varonis Threat Labs reported in July 2026 on Dolphin X, a subscription stealer sold on a cybercrime forum that advertises an "AI behavioral profiler" which scores victims and emails the operator a ranked list each morning. Varonis analysed the operator panel and traffic rather than an infected machine, so those capabilities are unverified, and it is unclear whether Dolphin X's scoring is AI at all or simple rules. VOLTA differs in that Talos has the binary and can show the prompt, endpoint and fallback list.

Our own coverage has followed the wider pattern of AI in attacks, including how the Vapor Panda group used AI agents against 200 organisations and AI-agent attacks hidden in GitHub issue text.

How it works

The technical choices in the AI stage are the most telling, according to Talos:

• Endpoint: the OpenRouter chat completions API, with hand-built JSON, no SDK, and a browser-style User-Agent.
• Model chain: anthropic/claude-opus-4.6 first, then moonshotai/kimi-k2, then google/gemini-2.5-flash. The malware checks each reply for refusal phrases and, if it finds one, tries the next model, up to three in all. Talos says the full list of phrases is not known beyond examples such as "I can't".
• Settings: temperature 0.2, which favours consistent, direct answers.
• Optional by design: with no API key the stage is skipped.
• Builder model: Talos believes VOLTA is sold as a builder service. Six template slots, such as the buyer's Telegram channel, API keys and settings, are filled at build time and a custom binary is compiled per order. The credentials in those slots are encrypted with a key derived from two constants in the binary, which Talos says offers no meaningful protection.

Three archives are staged for exfiltration, volta_log.zip, volta_dox.zip and volta_doxnet.zip, and the malware deletes itself afterwards.

What it means

For defenders, the AI call is a detection opportunity as well as a worry. Because the sample talks to OpenRouter, outbound traffic to that service from a machine with no reason to use it may be worth a look (this is our inference, not a Talos detection rule). The stronger defences remain the ordinary ones in Talos's list: control which programs run, stop unknown processes driving a headless browser, and keep credentials in hardware-backed stores so a stolen file is not enough.

For AI providers, the fallback chain is the notable detail. The author expected refusals and wrote around them. Talos says "refusal resilience may become a standard design requirement" for AI-enabled malware. Whether a model's safeguards fired here is not something Talos claims to know: it says it did not track whether the model answered, only that the malware is built to try again.

For everyone else, Talos's reading is modest: the AI adds "effort displacement rather than speed or scale". It replaces the manual work of reading through a victim's data and deciding what to do with it. That lowers the skill and time needed to run many infections, and makes the follow-up (extortion, account takeover, doxing) more targeted.

What we don't know yet

• How many people were infected, and whether the AI stage was used against real victims. Talos did not say it tracked this.
• Who writes and sells VOLTA. Talos reports no attacker-owned infrastructure.
• Whether the model responses were useful, or how often refusals happened.
• What the platforms involved (OpenRouter, Anthropic, Moonshot AI, Google) will do about abuse of their services. We have not seen a statement from any of them and have not asked.
• How the sample spreads: the Talos post as we read it does not describe a delivery method.

What to watch next

Watch for a statement from OpenRouter or the model providers on abuse controls, for other malware families found through CAIRN, and for further Talos detail such as detection rules. Security teams should check whether their tooling already flags the hashes and file names above.

Sources

• Cisco Talos: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer (primary)
• Unite.AI: Cisco Talos details VOLTA infostealer's LLM victim-ranking stage (secondary write-up of the Talos post)
• UT Regional Security Operations Center: the Dolphin X infostealer, summarising Varonis Threat Labs research