# VOLTA-AUTODOXER: AI-Powered Windows Infostealer Ranks Stolen Data by Monetization Value

> Cisco Talos reports VOLTA (VOLTA-AUTODOXER), a self-deleting Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, Microsoft OAuth tokens, SSH and cloud keys, then sends the loot to an LLM via the OpenRouter API to rank victim assets by monetization value and build an identity profile. It is sold on a builder model that compiles a custom binary per customer.

- **Published:** 2026-11-02T16:41:10Z
- **Last reviewed:** 2026-11-02T16:41:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5069
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5069.png
- **ID:** TL-2026-5069
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

VOLTA (tracked by Talos as VOLTA-AUTODOXER) is a PE32+ x86-64 Windows infostealer discovered through Talos' CAIRN effort to track malware that integrates frontier AI models. Its collection phase harvests browser passwords, cookies and saved payment cards from Chromium-based browsers and Firefox, cryptocurrency wallet seed phrases, Microsoft OAuth tokens, SSH and cloud-provider keys, plaintext Wi-Fi passwords and screenshots, plus session data for Discord, Telegram, Steam, Roblox, Slack, Battle.net, Thunderbird and Outlook. Talos advises defenders to restrict and alert on headless Chrome launches and to be aware of App-Bound Encryption (ABE) bypass.

Talos also reports inline cracking of cryptocurrency wallet vaults, theft of gcloud, OpenVPN and Hide.me configuration, Wi-Fi profile enumeration via the WlanGetProfileList API, and collection of document-authorship metadata and iPhone backup indicators. Talos contrasts VOLTA with CLOSEDQUORUM, another AI-integrated implant found through CAIRN, as part of a trend of attackers automating the analysis phase rather than collection.

An enrichment phase uses stolen sessions to pull Gmail receipts (Amazon, DoorDash, Uber Eats, Grubhub, Walmart, PayPal), Uber Eats/DoorDash order history and Discord profiles, and values Roblox inventories via Rolimons.com. This lets the malware infer geolocation, home address, employer, birth year, card last-4 digits, Slack workspaces and iPhone backup indicators.

The analysis phase posts a structured JSON bundle to the OpenRouter chat-completions endpoint (https://openrouter.ai/api/v1/chat/completions) using hand-assembled JSON with a Mozilla/5.0 User-Agent and no SDK. The primary model is anthropic/claude-opus-4.6, with fallbacks to moonshotai/kimi-k2 and then google/gemini-2.5-flash at temperature 0.2. The system prompt casts the model as a forensic intelligence analyst drafting a target assessment, with sections 'WHAT THEY'RE WORTH' and 'THEIR OPSEC'. The malware checks responses for refusal phrases such as 'I can't' or 'I'm not able' and cascades to the next model.

Output is written locally as Identity_Report.txt and AI_Analysis.txt, and exfiltrated in a three-stage process via volta_log.zip, volta_dox.zip (containing the two reports) and volta_doxnet.zip. Delivery occurs through a Telegram channel configured in the binary template. No persistence is documented; the malware deletes itself after running, but leaves a timestamped harvest log at %APPDATA%\volta_debug.txt. Every endpoint it contacts is a third-party service, so there is no attacker-owned infrastructure to block. The author sells access on a builder model: the customer supplies values for six template slots, protected only by weak SHA-256(constants)-based encryption, and the builder compiles a custom binary per order. The sample's PE timestamp is 2026-08-17 and it was first observed 2026-10-11. No CVEs, attribution or actor name are given in the sources.

## MITRE ATT&CK

- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552.004 Private Keys
- T1550.004 Web Session Cookie
- T1070.004 File Deletion
- T1016.002 Wi-Fi Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1119 Automated Collection
- T1560 Archive Collected Data
- T1555 Credentials from Password Stores
- T1552.001 Credentials In Files
- T1114.002 Remote Email Collection
- T1027 Obfuscated Files or Information
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**VOLTA Infostealer - Headless Chrome/Edge (chrome.exe --headless) Launched by Unexpected Parent** (`TL-2026-5069-SPL-001`)

Detects chrome.exe or msedge.exe started with --headless by a parent process that is not a browser or a developer tool. Talos advises alerting on headless Chrome launches because VOLTA (VOLTA-AUTODOXER) uses it to get around App-Bound Encryption and harvest browser passwords, cookies and payment cards. Parents that run from user-writable paths or have a random 12-character executable name (the builder emits names like 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe) are ranked first. Behaviour-first, so it still fires on per-customer builder binaries with new hashes. Requires Sysmon process-creation logging (EventCode 1).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1539, T1005
- **Data sources:** sysmon, windows_process_creation, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 CommandLine="*--headless*" earliest=-24h
| where match(Image,"(?i)(chrome|msedge)[.]exe$")
| where NOT match(ParentImage,"(?i)(chrome|msedge|chromedriver|msedgedriver|code|devenv|node|java|idea64|rider64|webstorm64|pycharm64)[.]exe$")
| eval parent_user_writable=if(match(ParentImage,"(?i)(appdata|temp|downloads|programdata)"),1,0), parent_random_name=if(match(ParentImage,"(?i)(^|[^a-z0-9])[a-z0-9]{12}[.]exe$"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host, User, ParentImage, parent_user_writable, parent_random_name
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort 0 -parent_random_name -parent_user_writable -count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("chrome.exe", "msedge.exe") and ProcessCommandLine has "--headless"
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "chromedriver.exe", "msedgedriver.exe", "node.exe", "Code.exe", "devenv.exe", "java.exe", "idea64.exe", "rider64.exe", "webstorm64.exe", "pycharm64.exe")
| extend ParentUserWritable = InitiatingProcessFolderPath has_any ("AppData", "Temp", "Downloads", "ProgramData"), ParentRandomName = InitiatingProcessFileName matches regex @"(?i)^[a-z0-9]{12}[.]exe$"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, ParentUserWritable, ParentRandomName
| order by ParentRandomName desc, ParentUserWritable desc, Timestamp desc
```

### Sigma

```yaml
title: VOLTA Infostealer - Headless Chrome or Edge Launched by Unexpected Parent
id: 3f6b8a52-9c41-4d7e-b2a1-5e0d7c91a4f3
status: experimental
description: Detects chrome.exe or msedge.exe launched with --headless by a parent that is not a browser or developer tool. VOLTA (VOLTA-AUTODOXER) uses headless Chromium to harvest browser credentials, cookies and cards while bypassing App-Bound Encryption.
references:
    - https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.collection
    - attack.t1005
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
        CommandLine|contains: '--headless'
    filter_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\chromedriver.exe'
            - '\msedgedriver.exe'
            - '\node.exe'
            - '\Code.exe'
            - '\devenv.exe'
            - '\java.exe'
    condition: selection_browser and not filter_parent
falsepositives:
    - Developer workstations running Selenium, Puppeteer or Playwright test automation
    - PDF or screenshot rendering services that drive headless Chrome
level: high
```

**Known false positives:**

- Developer workstations running Selenium, Puppeteer or Playwright test automation under a wrapper process not in the exclusion list
- Server-side PDF or screenshot rendering services that launch headless Chrome from a service host

**Tuning notes:** Add approved automation parents (CI agents, report renderers) to the ParentImage exclusion regex, or restrict the rule to non-developer endpoint groups. Alert on parent_random_name=1 or parent_user_writable=1 immediately and send the remaining hits to triage. Confirm Sysmon EventCode 1 is collected into index=endpoint; adjust the index name to your environment.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- VOLTA Infostealer - Known Sample Hash/Filename or Random-Name Binary Spawning Headless Browser (locked: unlock with TL Creds)
- VOLTA Infostealer - Non-Browser Process Reading Multiple Credential Stores (Browser, SSH, Cloud, OAuth) (locked: unlock with TL Creds)
- VOLTA Infostealer - Process Contacting LLM Gateway, Telegram and Account-Enrichment Services Together (locked: unlock with TL Creds)
- VOLTA Infostealer - Random-Name Binary in User Path Loading wlanapi.dll (Wi-Fi Profile Enumeration) (locked: unlock with TL Creds)
- VOLTA Infostealer - Self-Deleting Random-Name Executable in User Path (locked: unlock with TL Creds)
- VOLTA Infostealer - POST to OpenRouter Chat-Completions Endpoint from Corporate Egress (locked: unlock with TL Creds)
- VOLTA Infostealer - Harvest Log, Identity Report and Exfil Archive Creation (locked: unlock with TL Creds)
- VOLTA Infostealer - Non-Browser Process Resolving OpenRouter, Telegram or Rolimons (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- Domain: `openrouter[.]ai`
- File hash: `57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279`
- Domain: `rolimons[.]com`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Appraisal by AI: model-driven victim prioritization in the VOLTA infostealer (Cisco Talos)](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/)
- [AI-powered infostealer picks out the most profitable parts of your stolen data (Help Net Security)](https://www.helpnetsecurity.com/2026/11/02/ai-powered-infostealer-volta-victim-profiling/)
- [MITRE ATT&CK T1555.003 Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003/)
- [MITRE ATT&CK T1539 Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
- [MITRE ATT&CK T1528 Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [Talos releases CAIRN, uncovers LLM-voting malware CLOSEDQUORUM (AI Weekly)](https://aiweekly.co/alerts/talos-releases-cairn-uncovers-llm-voting-malware-closedquorum)
- [Cisco Talos open sources CAIRN to hunt AI-integrated malware (Unite.AI)](https://unite.ai/cisco-talos-open-sources-cairn-to-hunt-ai-integrated-malware)
- [OpenRouter API documentation (service abused by the malware)](https://openrouter.ai/docs)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5069