# VOLTA Infostealer (VOLTA-AUTODOXER) uses LLM-driven victim prioritization via OpenRouter

> VOLTA is a self-deleting Windows infostealer that harvests browser credentials, session tokens and cryptocurrency wallet data, then sends a locally assembled identity bundle to large language models through the OpenRouter API to rank victims by monetization value. Cisco Talos does not attribute it to a specific actor and describes a builder/commoditized deployment model with no attacker-owned infrastructure.

- **Published:** 2026-10-31T12:26:46Z
- **Last reviewed:** 2026-10-31T12:26:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4902
- **ID:** TL-2026-4902
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

VOLTA (self-named "VOLTA-AUTODOXER") is a compiled PE32+ x86-64 Windows infostealer surfaced through Cisco Talos's CAIRN research effort (the open-source framework for hunting AI-integrated malware that Talos released on 2026-09-22). Its stealer stage collects passwords, cookies and payment cards from Chromium-based browsers (relying on techniques to bypass Chrome App-Bound Encryption; Talos does not describe the method, but notes an application control policy restricting which processes may launch Chrome with --headless would block the ABE decryption path), plus Firefox, Thunderbird and Outlook profiles, SSH keys and cloud-provider configurations (gcloud, OpenVPN, Hide.me), Wi-Fi profiles (via the WlanGetProfileList API), screenshots, document authorship metadata, iPhone backup indicators, and session tokens for Slack, Steam, Battle.net, Discord, Telegram, Roblox and Microsoft OAuth. For cryptocurrency wallets it does not merely copy the file but runs an embedded password cracker against the vault inline.

After the stealer stage, VOLTA performs a network enrichment phase using the stolen sessions: it searches the victim's Gmail for purchase receipts (Amazon, DoorDash, Uber Eats, Grubhub, Walmart, PayPal) to verify a home address, pulls Uber Eats/DoorDash order history through authenticated sessions, enriches Discord account profiles, and values Roblox inventories through a live Rolimons.com lookup. The results are assembled locally into Identity_Report.txt (geolocation and home address, employer and domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, Roblox valuation).

The distinguishing TTP is the AI triage step. VOLTA posts the bundle as hand-assembled JSON (Mozilla/5.0 User-Agent) to https://openrouter.ai/api/v1/chat/completions at temperature 0.2 with a system prompt instructing the model to act as a forensic intelligence analyst drafting a target assessment, with sections "WHAT THEY'RE WORTH" (valuables ranked by monetization tier) and "THEIR OPSEC" (security posture and password hygiene). The primary model is anthropic/claude-opus-4.6, with a fallback chain of moonshotai/kimi-k2 then google/gemini-2.5-flash; the code checks each response for refusal phrases ("I can't", "I'm not able") before cascading to the next model. Output is written to AI_Analysis.txt. Talos characterizes this as effort displacement rather than a capability enhancement.

Exfiltration occurs in three stages as ZIP archives: volta_log.zip after the stealer runs, volta_dox.zip after AI analysis (AI_Analysis.txt and Identity_Report.txt), and volta_doxnet.zip if network enrichment produces results. A timestamped harvest log is left at %APPDATA%\volta_debug.txt even though the main executable deletes itself. Talos reports operators receive data exclusively through third-party services (OpenRouter, Telegram) and no actor-owned infrastructure was observed. The sample follows a builder model ("the author sells access, the customer provides their values") with six swappable build-time template slots such as the Telegram channel and API keys; embedded credentials are protected only by SHA-256 of two constants in the same binary and are recoverable through binary analysis. The sample has a PE timestamp of 2026-08-17 and was first seen 2026-10-11. The initial infection vector is not described in the source. Severity is analyst-assigned; no CVE, CVSS score or actor attribution is given.

## MITRE ATT&CK

- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1110.002 Password Cracking
- T1550.004 Web Session Cookie
- T1070.004 File Deletion
- T1016.002 Wi-Fi Discovery
- T1005 Data from Local System
- T1114 Email Collection
- T1119 Automated Collection
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service

## Sources

- [Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/)
- [Cisco Talos Intelligence Blog](https://blog.talosintelligence.com/)
- [Researchers uncover malware that uses AI to choose its next move (CAIRN / CLOSEDQUORUM)](https://www.helpnetsecurity.com/2026/09/22/cairn-open-source-framework-ai-malware-closedquorum/)
- [Cisco Talos open sources CAIRN to hunt AI-integrated malware](https://unite.ai/cisco-talos-open-sources-cairn-to-hunt-ai-integrated-malware)
- [OpenRouter API - Chat Completions](https://openrouter.ai/docs/api-reference/chat-completion)
- [MITRE ATT&CK T1555.003 - Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003/)
- [MITRE ATT&CK T1539 - Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
- [MITRE ATT&CK T1528 - Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [MITRE ATT&CK T1102 - Web Service](https://attack.mitre.org/techniques/T1102/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4902