Cisco Talos researcher Ryan Fetterman on October 31, 2026 revealed an evaluation of VOLTA-AUTODOXER, a self-deleting Home windows infostealer that follows a broad credential-theft move with a big language mannequin stage designed to rank every sufferer’s monetizable belongings.
Talos describes VOLTA as a mature stealer implant with an optionally available AI-integration layer, and says each noticed endpoint is third-party managed, with no attacker-owned infrastructure. In Talos’s evaluation, the novelty of the AI stage is that the mannequin works as an intelligence analyst on the operator’s behalf slightly than supporting a conventional malware functionality, changing a uncooked credential log right into a prioritized file of the sufferer’s monetizable belongings backed by citations.
The malware surfaced by way of Talos’s CAIRN analysis effort. Talos launched and open-sourced CAIRN, the Cognitive Artifact Intelligence Analysis Community, on September 22, 2026 as a toolkit for looking, classifying, and monitoring AI-integrated malware by way of metadata artifacts resembling embedded prompts, supplier endpoints, and API keys, with out downloading or executing the underlying binaries. Talos stated at launch that it will share its preliminary findings over time, starting with CLOSEDQUORUM, an implant it described as a completely autonomous multi-model consensus orchestrator with no human operator.
Assortment and Session Enrichment
A single VOLTA move extracts browser credentials, cookies, and saved fee playing cards throughout Chromium-based browsers, together with Firefox and Thunderbird information, Outlook profiles, Slack workspaces, Steam and Battle.web periods, Discord tokens, Telegram periods, Roblox accounts, Microsoft OAuth tokens, SSH and cloud-provider configuration recordsdata for gcloud, OpenVPN, and Cover.me, Wi-Fi profiles, and screenshots. Slightly than merely copying cryptocurrency wallets, the stealer runs an embedded cracker in opposition to the pockets vault throughout the identical move and data the end result on a WALLET VAULTS CRACKED line in its personal report. A direct WlanGetProfileList name dumps each saved Wi-Fi password on the host in plaintext.
A reside enrichment move then reuses the stolen periods. With the sufferer’s personal authenticated Gmail tokens, VOLTA searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to corroborate a house handle. It pulls Uber Eats and DoorDash order historical past straight, enriches the sufferer’s Discord profile by way of the stolen token, and values the Roblox stock by way of a reside lookup on Rolimons.com. The collected materials is assembled domestically right into a structured proof bundle containing geolocation and residential handle, employer and employer area, inferred start 12 months, card last-4 digits, Slack workspaces, doc authorship metadata, and iPhone backup indicators, then saved as Identity_Report.txt and serialized as JSON.
The mannequin’s returned evaluation is saved as AI_Analysis.txt, and exfiltration can happen in three staged archives: volta_log.zip after the stealer runs, volta_dox.zip after the AI name, and volta_doxnet.zip if the community enrichment produces something.
The OpenRouter Rating Stage
The serialized bundle is POSTed to the OpenRouter chat-completions endpoint underneath a system immediate instructing the mannequin to behave as “a forensic intelligence analyst drafting a goal evaluation.” The required output features a WHAT THEY’RE WORTH part rating the sufferer’s valuables by monetization worth throughout low, medium, and excessive tiers, and a THEIR OPSEC part assessing the sufferer’s safety posture and password hygiene. The immediate additionally pushes the mannequin to attach sparse information factors, resembling linking a sufferer’s title, handle, or college to patterns of their passwords. Talos notes the mannequin just isn’t being requested to search out information a lot as to attract inferences that reach the worth of what was already scraped.
The hardcoded configuration makes use of anthropic/claude-opus-4.6 because the default mannequin, with a fallback chain of moonshotai/kimi-k2 after which google/gemini-2.5-flash, a temperature of 0.2, and hand-assembled JSON requests with no SDK and a Mozilla/5.0 Consumer-Agent. Talos says the low temperature suggests the operator is emphasizing accuracy and consistency, and describes the cascading chain as a pivot to smaller, extra permissive fashions when refusals happen.
VOLTA checks every mannequin response for refusal phrases resembling “I can’t” earlier than transferring down a series of as much as three fashions, and it will possibly run with out the LLM stage completely if no API secret’s current. All the inference round-trip runs on the sufferer’s machine over the sufferer’s personal community connection; solely afterward is the consequence exfiltrated.
Builder Deployment and Countermeasures
Slightly than hardcoding its Telegram channel, API keys, and settings, VOLTA is compiled from a template with six swappable slots crammed at construct time. Talos says this factors to a builder mannequin wherein the creator sells entry, consumers provide their very own values, and a customized binary is compiled for every order. If that mannequin holds, the evaluation notes, the AI file is a industrial characteristic that lets a buyer of any sophistication degree obtain ranked goal assessments in a Telegram inbox, slightly than a functionality the creator constructed for private use. The slot credentials are encrypted with a key derived because the SHA-256 of two constants sitting in the identical binary, which Talos says supplies no significant safety as a result of anybody who reverses the file can get better them.
A lot of VOLTA’s token theft is dependent upon bypassing App-Certain Encryption in Chrome. Talos says an utility management coverage proscribing which processes could launch Chrome with the headless flag would block that decryption path completely, and at minimal recommends alerting when Chrome launches headless from an surprising course of, together with hardware-backed credential storage. After a compromise, Talos advises preserving the volta_debug.txt file, a timestamped harvest log recording precisely what was collected and whether or not the LLM name succeeded, then revoking doubtlessly compromised tokens and altering passwords. Any pockets whose seed phrase sat in plaintext on disk must be handled as absolutely compromised, with funds migrated to a brand new pockets whose seed is generated on an air-gapped gadget.
In Talos’s framing, the development the AI layer brings is effort displacement slightly than pace or scale, the identical underlying logic Talos recognized in CLOSEDQUORUM, utilized to a unique section of the operation. As AI integration in malware matures, the evaluation concludes, refusal resilience could develop into an ordinary design requirement.
Talos lists the analyzed pattern as a PE32+ x86-64 binary with the SHA-256 hash 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, noticed underneath the filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe, carrying a PE timestamp of August 17, 2026 and first seen at 12:46 UTC on October 11, 2026.