VOLTA-AUTODOXER: AI-Powered Windows Infostealer Ranks Stolen Data by Monetization Value

Key facts for VOLTA infostealer

Detection coverage for VOLTA infostealer

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5069 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: VOLTA Infostealer - Headless Chrome/Edge (chrome.exe --headless) Launched by Unexpected Parent

Detects chrome.exe or msedge.exe started with --headless by a parent process that is not a browser or a developer tool. Talos advises alerting on headless Chrome launches because VOLTA (VOLTA-AUTODOXER) uses it to get around App-Bound Encryption and harvest browser passwords, cookies and payment cards. Parents that run from user-writable paths or have a random 12-character executable name (the builder emits names like 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe) are ranked first. Behaviour-first, so it still fires on per-customer builder binaries with new hashes. Requires Sysmon process-creation logging (EventCode 1).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555.003, T1539, T1005
• Data sources: sysmon, windows_process_creation, DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 CommandLine="*--headless*" earliest=-24h
| where match(Image,"(?i)(chrome|msedge)[.]exe$")
| where NOT match(ParentImage,"(?i)(chrome|msedge|chromedriver|msedgedriver|code|devenv|node|java|idea64|rider64|webstorm64|pycharm64)[.]exe$")
| eval parent_user_writable=if(match(ParentImage,"(?i)(appdata|temp|downloads|programdata)"),1,0), parent_random_name=if(match(ParentImage,"(?i)(^|[^a-z0-9])[a-z0-9]{12}[.]exe$"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host, User, ParentImage, parent_user_writable, parent_random_name
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort 0 -parent_random_name -parent_user_writable -count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("chrome.exe", "msedge.exe") and ProcessCommandLine has "--headless"
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "chromedriver.exe", "msedgedriver.exe", "node.exe", "Code.exe", "devenv.exe", "java.exe", "idea64.exe", "rider64.exe", "webstorm64.exe", "pycharm64.exe")
| extend ParentUserWritable = InitiatingProcessFolderPath has_any ("AppData", "Temp", "Downloads", "ProgramData"), ParentRandomName = InitiatingProcessFileName matches regex @"(?i)^[a-z0-9]{12}[.]exe$"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, ParentUserWritable, ParentRandomName
| order by ParentRandomName desc, ParentUserWritable desc, Timestamp desc

Sigma

title: VOLTA Infostealer - Headless Chrome or Edge Launched by Unexpected Parent
id: 3f6b8a52-9c41-4d7e-b2a1-5e0d7c91a4f3
status: experimental
description: Detects chrome.exe or msedge.exe launched with --headless by a parent that is not a browser or developer tool. VOLTA (VOLTA-AUTODOXER) uses headless Chromium to harvest browser credentials, cookies and cards while bypassing App-Bound Encryption.
references:
    - https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.collection
    - attack.t1005
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
        CommandLine|contains: '--headless'
    filter_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\chromedriver.exe'
            - '\msedgedriver.exe'
            - '\node.exe'
            - '\Code.exe'
            - '\devenv.exe'
            - '\java.exe'
    condition: selection_browser and not filter_parent
falsepositives:
    - Developer workstations running Selenium, Puppeteer or Playwright test automation
    - PDF or screenshot rendering services that drive headless Chrome
level: high

Known false positives:

• Developer workstations running Selenium, Puppeteer or Playwright test automation under a wrapper process not in the exclusion list
• Server-side PDF or screenshot rendering services that launch headless Chrome from a service host

Tuning notes: Add approved automation parents (CI agents, report renderers) to the ParentImage exclusion regex, or restrict the rule to non-developer endpoint groups. Alert on parent_random_name=1 or parent_user_writable=1 immediately and send the remaining hits to triage. Confirm Sysmon EventCode 1 is collected into index=endpoint; adjust the index name to your environment.

• 🔒 VOLTA Infostealer - Known Sample Hash/Filename or Random-Name Binary Spawning Headless Browser · unlock with TL Creds
• 🔒 VOLTA Infostealer - Non-Browser Process Reading Multiple Credential Stores (Browser, SSH, Cloud, OAuth) · unlock with TL Creds
• 🔒 VOLTA Infostealer - Process Contacting LLM Gateway, Telegram and Account-Enrichment Services Together · unlock with TL Creds
• 🔒 VOLTA Infostealer - Random-Name Binary in User Path Loading wlanapi.dll (Wi-Fi Profile Enumeration) · unlock with TL Creds
• 🔒 VOLTA Infostealer - Self-Deleting Random-Name Executable in User Path · unlock with TL Creds
• 🔒 VOLTA Infostealer - POST to OpenRouter Chat-Completions Endpoint from Corporate Egress · unlock with TL Creds
• 🔒 VOLTA Infostealer - Harvest Log, Identity Report and Exfil Archive Creation · unlock with TL Creds
• 🔒 VOLTA Infostealer - Non-Browser Process Resolving OpenRouter, Telegram or Rolimons · unlock with TL Creds

Indicators of compromise for VOLTA infostealer

As of 2026-11-02, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5069.

Sample indicators (3 of 17)

• Domain: openrouter[.]ai
• File hash: 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
• Domain: rolimons[.]com

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

How VOLTA infostealer works

It is sold on a builder model that compiles a custom binary per customer.

VOLTA (tracked by Talos as VOLTA-AUTODOXER) is a PE32+ x86-64 Windows infostealer discovered through Talos' CAIRN effort to track malware that integrates frontier AI models. Its collection phase harvests browser passwords, cookies and saved payment cards from Chromium-based browsers and Firefox, cryptocurrency wallet seed phrases, Microsoft OAuth tokens, SSH and cloud-provider keys, plaintext Wi-Fi passwords and screenshots, plus session data for Discord, Telegram, Steam, Roblox, Slack, Battle.net, Thunderbird and Outlook. Talos advises defenders to restrict and alert on headless Chrome launches and to be aware of App-Bound Encryption (ABE) bypass.

Talos also reports inline cracking of cryptocurrency wallet vaults, theft of gcloud, OpenVPN and Hide.me configuration, Wi-Fi profile enumeration via the WlanGetProfileList API, and collection of document-authorship metadata and iPhone backup indicators. Talos contrasts VOLTA with CLOSEDQUORUM, another AI-integrated implant found through CAIRN, as part of a trend of attackers automating the analysis phase rather than collection.

An enrichment phase uses stolen sessions to pull Gmail receipts (Amazon, DoorDash, Uber Eats, Grubhub, Walmart, PayPal), Uber Eats/DoorDash order history and Discord profiles, and values Roblox inventories via Rolimons.com. This lets the malware infer geolocation, home address, employer, birth year, card last-4 digits, Slack workspaces and iPhone backup indicators.

The analysis phase posts a structured JSON bundle to the OpenRouter chat-completions endpoint (https://openrouter.ai/api/v1/chat/completions) using hand-assembled JSON with a Mozilla/5.0 User-Agent and no SDK. The primary model is anthropic/claude-opus-4.6, with fallbacks to moonshotai/kimi-k2 and then google/gemini-2.5-flash at temperature 0.2. The system prompt casts the model as a forensic intelligence analyst drafting a target assessment, with sections 'WHAT THEY'RE WORTH' and 'THEIR OPSEC'. The malware checks responses for refusal phrases such as 'I can't' or 'I'm not able' and cascades to the next model.

Output is written locally as Identity_Report.txt and AI_Analysis.txt, and exfiltrated in a three-stage process via volta_log.zip, volta_dox.zip (containing the two reports) and volta_doxnet.zip. Delivery occurs through a Telegram channel configured in the binary template. No persistence is documented; the malware deletes itself after running, but leaves a timestamped harvest log at %APPDATA%\volta_debug.txt. Every endpoint it contacts is a third-party service, so there is no attacker-owned infrastructure to block. The author sells access on a builder model: the customer supplies values for six template slots, protected only by weak SHA-256(constants)-based encryption, and the builder compiles a custom binary per order. The sample's PE timestamp is 2026-08-17 and it was first observed 2026-10-11. No CVEs, attribution or actor name are given in the sources.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1114.002 Remote Email Collection; T1119 Automated Collection; T1560 Archive Collected Data

Discovery

T1016.002 Wi-Fi Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion

Command and Control

T1071.001 Web Protocols

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers

lateral-movement

T1550.004 Web Session Cookie

Exfiltration

T1567 Exfiltration Over Web Service

Remediation for VOLTA infostealer

Immediate actions

• Preserve %APPDATA%\volta_debug.txt from suspected hosts for investigation
• Revoke and rotate stolen browser sessions, Microsoft OAuth tokens, Discord/Telegram/Steam/Roblox sessions, SSH keys and cloud-provider keys on affected hosts
• Change passwords for all accounts saved in browsers on affected hosts
• Migrate funds from exposed cryptocurrency wallets to new wallets whose seeds were generated on an air-gapped device

Workarounds

• Restrict the ability to launch Chrome with --headless to developer workstations and approved tooling

Longer-term hardening

• Use hardware-backed credential storage and keep browser App-Bound Encryption enabled
• Alert on headless Chrome launched by non-developer processes
• Hunt for endpoints making OpenRouter or Telegram API calls from non-browser, non-approved processes

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows (x86-64) endpoints

Timeline of VOLTA infostealer

• 2026-08-17 PE compile timestamp of the analyzed locked-ioc-17 sample (20:35 UTC)
• 2026-09-22 Cisco Talos releases CAIRN (Cognitive Artifact Intelligence Research Network), the open-source toolkit for hunting AI-integrated malware through which locked-ioc-17 was later found; its headline find was CLOSEDQUORUM
• 2026-10-11 Sample with SHA-256 locked-ioc-1 first observed (12:46 UTC)
• 2026-11-02 Talos guidance: restrict and alert on headless Chrome launches, preserve volta_debug.txt, revoke tokens and migrate crypto wallets
• 2026-11-02 Help Net Security reports on locked-ioc-17's AI-based victim profiling
• 2026-11-02 Cisco Talos publishes analysis of locked-ioc-17's LLM-driven victim prioritization, discovered via the CAIRN effort

Sources cited for VOLTA infostealer

• Appraisal by AI: model-driven victim prioritization in the VOLTA infostealer (Cisco Talos) Cisco Talos · Research · 2026-11-02
• MITRE ATT&CK T1555.003 Credentials from Web Browsers MITRE · Research
• MITRE ATT&CK T1539 Steal Web Session Cookie MITRE · Research
• MITRE ATT&CK T1528 Steal Application Access Token MITRE · Research
• OpenRouter API documentation (service abused by the malware) openrouter.ai · Vendor report
• AI-powered infostealer picks out the most profitable parts of your stolen data (Help Net Security) Help Net Security · News · 2026-11-02
• Talos releases CAIRN, uncovers LLM-voting malware CLOSEDQUORUM (AI Weekly) aiweekly.co · News · 2026-09-22
• Cisco Talos open sources CAIRN to hunt AI-integrated malware (Unite.AI) unite.ai · News · 2026-09-22

More in malware

• ScarfaceStealer: Sandbox-Aware Anti-Analysis and Blockchain-Based C2 Configuration (Electron/NSIS Loader)
• Infostealers Weekly Report 2026-10-26 to 2026-11-02: Generic Stealer, Warden Stealer, Acreed, Remus, Vidar
• CyberStrikeAI: AI-orchestrated pentest/C2 framework used in real-world attacks on educational institutions in Africa and Latin America
• Cryptomining Campaign Targeting Linux SSH Servers (XMRig, ShellBot, XHide, Go-based downloaders)
• SloppyRAT: New ClickFix-Delivered Remote Access Trojan Supporting Ransomware Operations