Threat intel

On October 31, Cisco Talos published its analysis of VOLTA, a self-deleting Windows infostealer that names itself VOLTA-AUTODOXER in its own code. It takes the usual stealer haul of browser passwords, cookies, cards, crypto wallets and app sessions, then uses the stolen sessions to look the victim up, and finally sends the whole profile to a commercial AI model with a request for a ranked "target assessment". Talos found it through CAIRN, the same research project that turned up CLOSEDQUORUM in September.

Any Windows user who saves passwords in a browser and stays signed in to Gmail, Outlook, Slack or Microsoft 365 is in scope. The AI step changes the economics for the buyer: instead of sifting thousands of stealer logs by hand, the operator gets a written verdict on which victims have money, crypto or corporate access worth chasing, and where that person lives. Talos describes VOLTA as a "mature stealer implant with an optional AI-integration layer": the theft works with or without the model.

How it works

The sample Talos analysed is a 64-bit Windows executable (SHA-256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279), seen under the random names 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe. Its compile timestamp is August 17, 2026, and it was first seen on October 11. Neither Talos nor the outlets covering it describe how it reaches victims.

Collection is broad. VOLTA pulls credentials, cookies and saved cards from Chromium browsers, plus Firefox, Thunderbird and Outlook profiles, Slack workspaces, Discord tokens, Telegram sessions, Steam, Battle.net and Roblox accounts, Microsoft OAuth tokens, SSH keys, gcloud, OpenVPN and Hide.me configuration, and screenshots. It reads saved Wi-Fi passwords by calling the Windows WlanGetProfileList API directly, so detection rules that watch for netsh wlan show profile ... key=clear will not fire. Wallets are copied and attacked on the spot by a built-in cracker.

Much of the token theft depends on getting past Chrome's App-Bound Encryption, the feature that ties cookie and password decryption to the Chrome process itself. Talos does not publish the full method, but its countermeasures point at Chrome being started with --headless, a windowless mode meant for automation and testing.

Next comes enrichment. With the stolen Gmail session, VOLTA searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address. It queries Uber Eats and DoorDash for order history, reuses the Discord token to fill out the account profile, and prices Roblox inventory with a live lookup on Rolimons, a Roblox item trading site. The result is written to Identity_Report.txt, covering identity, employer, location, money and accounts.

The AI appraisal

The report is posted to OpenRouter's chat completions API, a service that forwards one request to many model vendors under a single key. The default model is anthropic/claude-opus-4.6. If the reply contains refusal phrases such as "I can't" or "I'm not able", VOLTA retries with moonshotai/kimi-k2 and then google/gemini-2.5-flash. The request is hand-built JSON with a browser-style Mozilla/5.0 User-Agent and a temperature of 0.2, which keeps the output consistent from one victim to the next.

The system prompt casts the model as "a forensic intelligence analyst drafting a target assessment". It must produce two sections. "WHAT THEY'RE WORTH" ranks the victim's assets in low, medium and high tiers, with citations back to the stolen evidence. "THEIR OPSEC" judges the victim's security habits and password hygiene, and the prompt asks the model to connect names, addresses or universities to patterns in the victim's passwords. In our reading, that second section gives the buyer a head start on guessing passwords for accounts the stealer did not capture.

The answer is saved as AI_Analysis.txt. Results leave in three archives: volta_log.zip after collection, volta_dox.zip with the report and the AI analysis, and volta_doxnet.zip when enrichment found something. If no API key is configured, the AI step is skipped.

Who is using it

Talos reads VOLTA as a product sold to customers. Each build fills six template slots at compile time with the buyer's own channel, API keys and settings, and all observed endpoints belong to third parties rather than attacker servers. The embedded values are "encrypted" with a key derived from constants in the same binary, so anyone reversing a sample can recover the buyer's keys. Talos names no actor and reports no victim count.

VOLTA is not the first stealer to score its victims. In July, Varonis described Dolphin X, whose "AI Profiler" ranks infected machines in the operator's panel, though Varonis could not tell which model sat behind it.

What to do

On endpoints:

• Use an application control or EDR blocking policy that limits which processes may start Chrome with --headless. Talos says this blocks the App-Bound Encryption decryption path entirely. At minimum, alert when a process that is not a known developer tool does it.
• Alert on connections to openrouter.ai from anything that is not a known AI client. Few endpoint applications have a reason to call it.
• Move credentials out of the browser into hardware-backed stores and passkeys where the service supports them, so there is less for any stealer to read.

In Microsoft Defender for Endpoint advanced hunting, both signals fit in two short queries:

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "chrome.exe" and ProcessCommandLine has "--headless"
| summarize count() by InitiatingProcessFileName, InitiatingProcessFolderPath, DeviceName

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has "openrouter.ai"
| summarize count() by InitiatingProcessFileName, InitiatingProcessFolderPath, DeviceName

A headless Chrome whose parent is an unsigned executable in a user or Temp folder is the row to investigate first. Also search for the hash above, the three zip names and %APPDATA%\volta_debug.txt.

If a machine was infected

Copy %APPDATA%\volta_debug.txt before anything else. It is a timestamped log of what was collected and whether the AI call succeeded, and it survives the executable deleting itself. Then isolate and re-image the PC, and do all rotation from a clean device.

The order follows what VOLTA's own ranking would put at the top. Wallets come first: Talos says a seed phrase stored in plaintext means the wallet is fully compromised, so move funds to a new wallet whose seed was generated on an air-gapped device. Email and Microsoft 365 come next, because they reset everything else and VOLTA already read the inbox. In the Microsoft Entra admin center, open the user and choose Revoke sessions, which invalidates refresh tokens, then reset the password and check inbox rules and OAuth app consents. For Google Workspace, reset the user's sign-in cookies in the Admin console.

Have saved cards reissued. Replace any SSH key pair that lived on the machine and remove its public key from every authorized_keys file, revoke gcloud credentials, and reissue VPN profiles. For Slack, Discord, Telegram and Steam, sign out all other sessions, then change the password. Finally, change any password built from personal details such as a child's name, a street or a university, because the "THEIR OPSEC" section is written to guess exactly those.

Stealer detection, headless browser alerts and session revocation runbooks are part of our security operations work, and moving credentials out of browsers is part of safeguarding and hardening. If you think a machine of yours ran VOLTA or a similar stealer, open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Cisco Talos, The Hacker News, GBHackers, Brandefense, Cybersecurity News, BleepingComputer on Dolphin X, Hackread on Dolphin X.