Threat reportMalwareTL-2026-4902
VOLTA Infostealer (VOLTA-AUTODOXER) uses LLM-driven victim prioritization via OpenRouter
VOLTA Infostealer (VOLTA-AUTODOXER) uses LLM-driven victim (TL-2026-4902), also tracked as VOLTA-AUTODOXER, is a high-severity malware campaign, first published 2026-10-31. It has no confirmed attribution, affects Microsoft Windows, maps to 15 MITRE ATT&CK techniques (T1005, T1016.002, T1070.004), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-4902
- Threat ID
- TL-2026-4902
- Also known as
- VOLTA-AUTODOXER
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, gaming, cryptocurrency, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in VOLTA Infostealer (VOLTA-AUTODOXER) uses LLM-driven victim
Malware and tooling: VOLTA-AUTODOXER, telegram
How VOLTA Infostealer (VOLTA-AUTODOXER) uses LLM-driven victim works
VOLTA is a self-deleting Windows infostealer that harvests browser credentials, session tokens and cryptocurrency wallet data, then sends a locally assembled identity bundle to large language models through the OpenRouter API to rank victims by monetization value. Cisco Talos does not attribute it to a specific actor and describes a builder/commoditized deployment model with no attacker-owned infrastructure.
VOLTA (self-named "VOLTA-AUTODOXER") is a compiled PE32+ x86-64 Windows infostealer surfaced through Cisco Talos's CAIRN research effort (the open-source framework for hunting AI-integrated malware that Talos released on 2026-09-22). Its stealer stage collects passwords, cookies and payment cards from Chromium-based browsers (relying on techniques to bypass Chrome App-Bound Encryption; Talos does not describe the method, but notes an application control policy restricting which processes may launch Chrome with --headless would block the ABE decryption path), plus Firefox, Thunderbird and Outlook profiles, SSH keys and cloud-provider configurations (gcloud, OpenVPN, Hide.me), Wi-Fi profiles (via the WlanGetProfileList API), screenshots, document authorship metadata, iPhone backup indicators, and session tokens for Slack, Steam, Battle.net, Discord, Telegram, Roblox and Microsoft OAuth. For cryptocurrency wallets it does not merely copy the file but runs an embedded password cracker against the vault inline.
After the stealer stage, VOLTA performs a network enrichment phase using the stolen sessions: it searches the victim's Gmail for purchase receipts (Amazon, DoorDash, Uber Eats, Grubhub, Walmart, PayPal) to verify a home address, pulls Uber Eats/DoorDash order history through authenticated sessions, enriches Discord account profiles, and values Roblox inventories through a live Rolimons.com lookup. The results are assembled locally into Identity_Report.txt (geolocation and home address, employer and domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, Roblox valuation).
The distinguishing TTP is the AI triage step. VOLTA posts the bundle as hand-assembled JSON (Mozilla/5.0 User-Agent) to https://openrouter.ai/api/v1/chat/completions at temperature 0.2 with a system prompt instructing the model to act as a forensic intelligence analyst drafting a target assessment, with sections "WHAT THEY'RE WORTH" (valuables ranked by monetization tier) and "THEIR OPSEC" (security posture and password hygiene). The primary model is anthropic/claude-opus-4.6, with a fallback chain of moonshotai/kimi-k2 then google/gemini-2.5-flash; the code checks each response for refusal phrases ("I can't", "I'm not able") before cascading to the next model. Output is written to AI_Analysis.txt. Talos characterizes this as effort displacement rather than a capability enhancement.
Exfiltration occurs in three stages as ZIP archives: volta_log.zip after the stealer runs, volta_dox.zip after AI analysis (AI_Analysis.txt and Identity_Report.txt), and volta_doxnet.zip if network enrichment produces results. A timestamped harvest log is left at %APPDATA%\volta_debug.txt even though the main executable deletes itself. Talos reports operators receive data exclusively through third-party services (OpenRouter, Telegram) and no actor-owned infrastructure was observed. The sample follows a builder model ("the author sells access, the customer provides their values") with six swappable build-time template slots such as the Telegram channel and API keys; embedded credentials are protected only by SHA-256 of two constants in the same binary and are recoverable through binary analysis. The sample has a PE timestamp of 2026-08-17 and was first seen 2026-10-11. The initial infection vector is not described in the source. Severity is analyst-assigned; no CVE, CVSS score or actor attribution is given.
MITRE ATT&CK techniques used in TL-2026-4902
Collection
T1005 Data from Local System; T1113 Screen Capture; T1114 Email Collection; T1119 Automated Collection; T1560 Archive Collected Data
Discovery
Defense Evasion
Command and Control
Credential Access
T1110.002 Password Cracking; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
lateral-movement
Exfiltration
Affected products and versions in VOLTA Infostealer (VOLTA-AUTODOXER) uses LLM-driven victim
Remediation for VOLTA Infostealer (VOLTA-AUTODOXER) uses LLM-driven victim
Immediate actions
- Alert on Chrome launched with --headless from non-developer parent processes
- Hunt for %APPDATA%\volta_debug.txt, Identity_Report.txt, AI_Analysis.txt and volta_log.zip/volta_dox.zip/volta_doxnet.zip on endpoints
- Hunt for SHA256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 and filenames 9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe
- Alert on unexpected endpoint connections to openrouter.ai/api/v1/chat/completions from non-approved processes
- On confirmed compromise, preserve %APPDATA%\volta_debug.txt for forensics, revoke compromised session tokens and change passwords
Workarounds
- Migrate cryptocurrency funds to wallets generated on an air-gapped device if wallets were exposed
- Revoke Discord, Telegram, Steam, Roblox, Slack and Microsoft OAuth sessions on affected accounts
Longer-term hardening
- Apply application control policy restricting which processes may launch Chrome with --headless
- Store credentials in hardware-backed stores
- Restrict or proxy access to LLM API gateways from user endpoints
Timeline of VOLTA Infostealer (VOLTA-AUTODOXER) uses LLM-driven victim
- PE timestamp of the VOLTA sample (PE32+ x86-64) is 2026-08-17 20:35 UTC
- Cisco Talos releases CAIRN, an open-source framework for hunting AI-integrated malware (scanning for prompt templates, API endpoints and jailbreak terms), and documents CLOSEDQUORUM, an LLM-voting Go implant; CAIRN is the research effort through which VOLTA was later surfaced
- Sample SHA256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 first seen at 12:46 UTC, observed as 9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe
- Talos recommends restricting Chrome --headless launches, preserving %APPDATA%\volta_debug.txt, revoking tokens and migrating crypto funds
- Talos describes the builder model with six swappable template slots and credentials protected only by SHA-256 of two in-binary constants; no actor-owned infrastructure observed
- Talos documents three-stage ZIP exfiltration (volta_log.zip, volta_dox.zip, volta_doxnet.zip) and the surviving %APPDATA%\volta_debug.txt harvest log
- Talos documents the OpenRouter LLM chain: anthropic/claude-opus-4.6, then moonshotai/kimi-k2, then google/gemini-2.5-flash, with refusal-phrase failover and temperature 0.2
- Cisco Talos publishes 'Appraisal by AI', documenting VOLTA-AUTODOXER, found via the CAIRN research effort
Sources cited for VOLTA Infostealer (VOLTA-AUTODOXER) uses LLM-driven victim
- Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
- Cisco Talos Intelligence Blog
- Researchers uncover malware that uses AI to choose its next move (CAIRN / CLOSEDQUORUM)
- Cisco Talos open sources CAIRN to hunt AI-integrated malware
- OpenRouter API - Chat Completions
- MITRE ATT&CK T1555.003 - Credentials from Web Browsers
- MITRE ATT&CK T1539 - Steal Web Session Cookie
- MITRE ATT&CK T1528 - Steal Application Access Token
- MITRE ATT&CK T1102 - Web Service
Detection coverage for TL-2026-4902
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4902 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.