Cisco Talos Details the VOLTA Infostealer: It Hands Stolen Data to an LLM to "Appraise" Victims, and Switches Models When One Refuses

Steal first, then have a model write a "target assessment"

An infostealer can grab huge amounts of data in one pass, but working out what is worth monetizing has usually meant an operator reading through logs. VOLTA, disclosed by Cisco Talos on October 31 (the sample calls itself VOLTA-AUTODOXER), hands that step to an LLM.

According to the report, VOLTA starts with conventional theft: passwords, cookies and saved payment cards from Chromium-based browsers and Firefox; Discord, Telegram, Steam and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider configs; every saved Wi-Fi password; and screenshots, plus inline cracking of crypto wallet vaults. It then uses the stolen sessions to enrich the haul: searching the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Walmart, PayPal and others to confirm a home address, pulling delivery order history, and valuing Roblox items through a live lookup.

The assembled data is sent through OpenRouter to an LLM. The system prompt tells the model to act as "a forensic intelligence analyst drafting a target assessment," and the output must include two sections: "WHAT THEY'RE WORTH," which ranks the victim's assets into low, medium and high monetization tiers, and "THEIR OPSEC," which assesses the victim's security posture and password hygiene. The prompt also encourages the model to connect sparse details such as names, addresses and universities to patterns in passwords.

Three models in a row

The default model hard-coded in the sample is Claude Opus 4.6, at a temperature of 0.2. The program checks replies for refusal phrases such as "I can't" or "I'm not able" and, if it finds one, falls back to Kimi K2 and then Gemini 2.5 Flash; if no API key is configured, the AI stage is skipped entirely and the theft proceeds as normal. Talos reads this as the author expecting refusals from the start, and says refusal resilience may become a standard design requirement as malware integrates AI.

The model call goes out from the victim's own machine and network, and the result is packaged with the raw data for exfiltration; Talos found no attacker-owned infrastructure. The sample keeps its Telegram channel, API keys and settings in six slots filled in at build time, which leads Talos to suggest it is sold as a builder: a buyer with no particular skill can receive ranked victim dossiers in a Telegram inbox.

Defensive guidance

Talos's view is that the AI here makes the attack neither faster nor larger in scale; it removes the operator's most labor-intensive step, the analysis. Its recommendations include restricting which processes may launch Chrome in headless mode and alerting on such launches from anything other than known developer tools; keeping credentials in hardware-backed stores; and, after a compromise, preserving the %APPDATA%\volta_debug.txt log to see what was taken, revoking tokens, changing passwords, and treating any wallet whose seed phrase sat in plaintext on disk as fully compromised and moving the funds. The report includes the sample's SHA-256; the sample was first seen on October 11, 2026.