What does VOLTA steal before it calls the LLM?

VOLTA collects browser passwords, cookies and saved payment cards, plus data from Outlook, Slack, Discord, Telegram, Steam and Roblox, SSH keys, cloud and VPN configs, crypto wallets and saved Wi-Fi passwords. Cisco Talos says it also uses stolen sessions to search Gmail for retail receipts and pull Uber Eats and DoorDash order history to confirm a home address.

What happens when the model refuses to analyze a victim?

VOLTA checks the model's reply for refusal phrases such as "I can't". If it finds one, it sends the same request to the next model in its chain on OpenRouter. Cisco Talos reads this fallback logic as a sign that the malware's operator expected some models to refuse the task.

Does VOLTA need the LLM to work?

No. Cisco Talos describes the LLM stage as optional: VOLTA still steals and sends data when no API key is set. The model step only adds the ranked assessment of the victim. Talos also notes that VOLTA has no attacker-owned servers, because every endpoint it was seen using is a third-party service.

What should I do if a machine was infected with VOLTA?

Cisco Talos advises keeping the file %APPDATA%\volta_debug.txt, which logs what VOLTA collected and whether the LLM call worked, even if the program deleted itself. Victims should revoke exposed tokens, change passwords, and move crypto funds to a new wallet made on an air-gapped device if a seed phrase was stored in plain text.

How can defenders detect VOLTA-style credential theft?

Cisco Talos recommends application control that limits which processes can start Chrome with the --headless flag, which blocks VOLTA's way around Chrome's App-Bound Encryption. At a minimum, teams should alert on headless Chrome started by anything outside known developer tools, and keep credentials in hardware-backed stores.

Cisco Talos · 2026-10-31 · major

VOLTA infostealer — malware asks an LLM how much each victim is worth

Cisco Talos found VOLTA, a Windows infostealer that sends a profile of each victim to an LLM through OpenRouter. The model ranks the victim's stolen assets by money value and rates their security habits, replacing the operator's own analysis.

Cisco Talos header image for its report on the VOLTA infostealer

A Windows infostealer sends each victim's stolen profile to an LLM, which ranks what the victim is worth.

Quick facts

Found by	Cisco Talos (CAIRN research), October 31, 2026
Platform	Windows (PE32+ x86-64), self-deleting
LLM access	OpenRouter chat completions API
Model chain	claude-opus-4.6, then kimi-k2, then gemini-2.5-flash
LLM output	AI_Analysis.txt with "WHAT THEY'RE WORTH" and "THEIR OPSEC"
First seen	October 11, 2026
Sold as	A builder: each customer gets a custom binary

What is it?

VOLTA (also called VOLTA-AUTODOXER) is a Windows infostealer that Cisco Talos found through its CAIRN research work. Its new feature is an optional LLM stage that works like an "intelligence analyst" for the criminal. After the theft, the model ranks the victim's valuables as low, medium or high and judges their password habits.

How does it work?

The malware puts everything it collected into Identity_Report.txt, turns it into JSON, and sends it with a system prompt to OpenRouter at temperature 0.2. Talos found claude-opus-4.6 as the default model, with kimi-k2 and gemini-2.5-flash as fallbacks when a reply contains a refusal phrase. The data sent includes home address, employer, inferred birth year, last four card digits and Slack workspaces.

Why does it matter?

Cisco Talos calls it effort displacement: the step that needed the most human attention, deciding which victim to exploit first, is now one API call. Because VOLTA uses only third-party services, there is no attacker server to block. Model providers and API routers become part of the attack chain, and refusal checks alone did not stop it, since the malware just tries another model.

Who is it for?

security teams and SOC analysts

Frequently asked questions

What does VOLTA steal before it calls the LLM?: VOLTA collects browser passwords, cookies and saved payment cards, plus data from Outlook, Slack, Discord, Telegram, Steam and Roblox, SSH keys, cloud and VPN configs, crypto wallets and saved Wi-Fi passwords. Cisco Talos says it also uses stolen sessions to search Gmail for retail receipts and pull Uber Eats and DoorDash order history to confirm a home address.
What happens when the model refuses to analyze a victim?: VOLTA checks the model's reply for refusal phrases such as "I can't". If it finds one, it sends the same request to the next model in its chain on OpenRouter. Cisco Talos reads this fallback logic as a sign that the malware's operator expected some models to refuse the task.
Does VOLTA need the LLM to work?: No. Cisco Talos describes the LLM stage as optional: VOLTA still steals and sends data when no API key is set. The model step only adds the ranked assessment of the victim. Talos also notes that VOLTA has no attacker-owned servers, because every endpoint it was seen using is a third-party service.
What should I do if a machine was infected with VOLTA?: Cisco Talos advises keeping the file %APPDATA%\volta_debug.txt, which logs what VOLTA collected and whether the LLM call worked, even if the program deleted itself. Victims should revoke exposed tokens, change passwords, and move crypto funds to a new wallet made on an air-gapped device if a seed phrase was stored in plain text.
How can defenders detect VOLTA-style credential theft?: Cisco Talos recommends application control that limits which processes can start Chrome with the --headless flag, which blocks VOLTA's way around Chrome's App-Bound Encryption. At a minimum, teams should alert on headless Chrome started by anything outside known developer tools, and keep credentials in hardware-backed stores.

Try it

Alert on Chrome started with --headless by processes outside known developer tools