VOLTA infostealer uses LLMs to rank victim value

1. Executive summary

Cisco Talos has documented a Windows infostealer it names VOLTA-AUTODOXER that, after harvesting credentials, sessions, payment cards and cryptocurrency wallets, serialises a dossier on the victim and sends it to a large language model through OpenRouter to rank the victim's assets by monetisation value. The implant is self-deleting, uses only third-party infrastructure, and ships as a builder with six swappable configuration slots, which points to a commodity tool sold to multiple operators rather than a single actor's kit. No CVE is associated with this item and no exploitation state is recorded against it; the risk is credential and session theft leading to account takeover and fraud, not software exploitation. For EMEA financial services the exposure is concentrated in staff and contractor endpoints: stolen Microsoft OAuth tokens, SSH and cloud-provider keys, Slack workspaces and browser payment cards give an operator material that can reach corporate SaaS and cloud estates, and the LLM stage exists to tell the buyer which of those is worth acting on first. Attribution to "VOLTA-AUTODOXER" is unconfirmed: no MITRE ATT&CK profile exists for that name and Talos presents it as the malware's self-assigned label, not a tracked actor.

2. Regulatory framing

3. Technical analysis & attack chain

VOLTA is a PE32+ x86-64 Windows executable, first seen 2026-10-11 12:46 UTC, with a PE timestamp of 2026-08-17 20:35. Talos observed it under the filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe. The source does not describe the initial access vector, so how the binary reaches a host is not established here.

Confirmed steps, in the order the implant performs them:

1. Collection. In a single pass the stealer extracts browser credentials, cookies and saved payment cards from Chromium-based browsers; it also targets Firefox and Thunderbird, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, and SSH and cloud-provider configuration files for gcloud, OpenVPN and Hide.me. It pulls Microsoft OAuth tokens, cryptocurrency wallet data and screenshots. Every saved Wi-Fi password on the machine is read through a direct call to WlanGetProfileList and written to plaintext.
2. Inline wallet cracking. Rather than only copying cryptocurrency wallets, VOLTA runs an embedded cracker against the vault during collection and writes the outcome to a WALLET VAULTS CRACKED line in its own report.
3. Live enrichment using stolen sessions. The implant reuses the victim's own authenticated sessions to extend the dossier: it queries the victim's Gmail inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to corroborate a home address; it calls Uber Eats and DoorDash order history directly; it enriches the Discord account profile with the stolen token; and it values Roblox inventory through a live lookup to Rolimons[.]com.
4. Local assembly. Collected and enriched data is written to Identity_Report.txt on the host.
5. LLM profiling. Identity_Report.txt is serialised as JSON and POSTed to OpenRouter with a system prompt instructing the model to act as "a forensic intelligence analyst drafting a target assessment". The required output includes a section titled "WHAT THEY'RE WORTH", ranking valuables by monetisation with a low/medium/high tier, and a section on "THEIR OPSEC" assessing the victim's security posture and password hygiene. The prompt also asks the model to draw inferences across sparse data, for example linking names, addresses or universities to password patterns. The response is written to AI_Analysis.txt.
6. Exfiltration. Identity_Report.txt and AI_Analysis.txt leave the host together in volta_dox.zip. The inference round-trip happens through the victim's own network connection, on the victim's machine, before exfiltration.
7. Self-deletion. The main executable deletes itself after execution.

The LLM configuration is hardcoded. The endpoint is https[:]//openrouter[.]ai/api/v1/chat/completions. The default model is anthropic/claude-opus-4.6, with a fallback chain of moonshotai/kimi-k2 then google/gemini-2.5-flash. Temperature is 0.2. Requests are hand-assembled JSON with no SDK and a User-Agent of Mozilla/5.0. The implant inspects each response for refusal phrases such as "I can't" or "I'm not able" and moves to the next model in the chain, up to three models. Talos states the implant can run without the LLM stage altogether if no API key is present.

The builder model. VOLTA does not hardcode its Telegram channel, API keys and settings in the binary. It uses a template with six swappable slots filled at build time, which Talos reads as evidence that the author sells access and compiles a custom binary per customer. The slot values are encrypted with a key derived from the SHA-256 of two constants in the same binary; anyone who reverses the file can recover them. The practical consequence is that the AI dossier is a product feature available to any buyer, not a capability reserved for a sophisticated operator.

Infrastructure. All observed endpoints are third-party controlled. There is no actor-owned infrastructure, so domain and IP blocklists built from this report will point at legitimate services (OpenRouter, Rolimons, the mail and delivery providers queried) and cannot be blocked wholesale.

Chrome App-Bound Encryption. Talos states much of the token-stealing capability relies on techniques to bypass App-Bound Encryption in Chrome. The source does not give the bypass mechanism, so the specific technique is not available here.

Confidence. The entire technical account, the model identifiers, the prompt structure, the builder assessment and the file indicators come from a single vendor report (Cisco Talos). The attribution name "VOLTA-AUTODOXER" is the malware's self-assigned label; no MITRE ATT&CK profile exists for it and Talos does not attribute the tool to a tracked actor. Treat the builder and commodity-sale assessment as Talos's inference from the six-slot template, not as established fact. Single-sourced; verify before enforcement.

4. Mitigation & containment

P1 (within 24 hours)

• Hunt for the two observed filenames (9BY0tjwOc3ut.exe, yLP9m5J3i2Aw.exe) and for the SHA-256 in §5 across EDR telemetry and email/web gateways. Because the binary self-deletes, absence of the executable does not mean absence of infection.
• Hunt for %APPDATA%\volta_debug.txt. Talos states this timestamped harvest log records exactly what was collected and whether the LLM call succeeded. Where it exists, preserve it before any cleanup; it is the primary evidence of scope.
• Hunt for Identity_Report.txt, AI_Analysis.txt and volta_dox.zip in user profile and temp paths. Their presence confirms collection and, for the first two, that the LLM stage ran.
• On any confirmed host, revoke all tokens and sessions that could have been harvested: Microsoft OAuth refresh tokens, Slack, Discord, Telegram, Steam, Battle.net, Roblox, and SSH and cloud-provider credentials (gcloud, OpenVPN, Hide.me). Change passwords for every account whose credentials were stored in a browser on that machine.
• For cryptocurrency wallets: if a seed phrase was stored in plaintext on disk, treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device.
• Block Chrome from being launched with --headless by any process not on a known developer allowlist, via application control policy. Talos states this blocks the App-Bound Encryption decryption path entirely. At minimum, alert on Chrome launched with --headless from any process outside that allowlist.

P2 (within 72 hours)

• Review the scope of any stolen cloud-provider keys against cloud audit logs for the period between first execution and containment, focusing on the services named in the harvested configs (gcloud, OpenVPN).
• Check mail and delivery-provider account activity for the victim accounts: Gmail receipt searches, Uber Eats and DoorDash order history access, and Discord profile changes are the enrichment actions the implant performs and may leave access-log traces.
• Move browser-stored credentials for privileged accounts into a hardware-backed credential store. Talos recommends hardware-backed stores; the specific product is an internal decision.

P3 (within 7 days)

• Add detection for outbound POSTs to openrouter[.]ai/api/v1/chat/completions from endpoints that have no business reason to call an LLM API, and for the User-Agent Mozilla/5.0 on JSON POSTs to that path from non-browser processes.
• Add the §6 YARA and Sigma rules to endpoint and SIEM detection content and tune against the false-positive rate from developer machines that legitimately run headless Chrome.
• Brief service desk and incident response on the token-revocation sequence above so that a single-endpoint stealer alert triggers credential rotation rather than a malware clean-up ticket.

5. Indicators of compromise

sha256  57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
filename  9BY0tjwOc3ut.exe
filename  yLP9m5J3i2Aw.exe
filepath  %APPDATA%\volta_debug.txt
filename  Identity_Report.txt
filename  AI_Analysis.txt
filename  volta_dox.zip
url  hxxps://openrouter[.]ai/api/v1/chat/completions
domain  openrouter[.]ai
domain  rolimons[.]com

Note on the network indicators: openrouter[.]ai and rolimons[.]com are legitimate third-party services. Talos states all observed endpoints are third-party controlled and there is no actor-owned infrastructure. Blocking these domains outright will break legitimate use; scope any block to endpoint processes that should not be calling them.

Behavioural indicators

6. Detection

rule VOLTA_AUTODOXER_Infostealer
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-31"
        reference = "https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/"
        description = "Detects VOLTA-AUTODOXER infostealer by its LLM endpoint, model identifiers, report filenames and prompt artefacts"
    strings:
        $ep      = "openrouter.ai/api/v1/chat/completions" ascii wide
        $m1      = "anthropic/claude-opus-4.6" ascii wide
        $m2      = "moonshotai/kimi-k2" ascii wide
        $m3      = "google/gemini-2.5-flash" ascii wide
        $r1      = "Identity_Report.txt" ascii wide
        $r2      = "AI_Analysis.txt" ascii wide
        $r3      = "volta_dox.zip" ascii wide
        $r4      = "volta_debug.txt" ascii wide
        $p1      = "WHAT THEY'RE WORTH" ascii wide
        $p2      = "THEIR OPSEC" ascii wide
        $p3      = "forensic intelligence analyst drafting a target assessment" ascii wide
        $p4      = "WALLET VAULTS CRACKED" ascii wide
        $ref1    = "I can't" ascii wide
        $ref2    = "I'm not able" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        filesize < 20MB and
        (
            (2 of ($ep, $m1, $m2, $m3)) or
            (2 of ($r1, $r2, $r3, $r4)) or
            (1 of ($p1, $p2, $p3, $p4) and 1 of ($ref1, $ref2))
        )
}

title: VOLTA-AUTODOXER LLM profiling and report artefacts
id: 8f3c2a71-4d6e-4b90-a1c5-7e2d9b0f6a13
status: experimental
description: Detects VOLTA-AUTODOXER behaviour, including creation of its harvest log and AI report files, headless Chrome launch for App-Bound Encryption bypass, and outbound calls to the OpenRouter chat completions endpoint.
author: Adverse Trace
date: 2026-10-31
references:

    - https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/
logsource:
    category: process_creation
    product: windows
detection:
    selection_chrome_headless:
        Image|endswith: '\chrome.exe'
        CommandLine|contains: '--headless'
    selection_openrouter_net:
        DestinationHostname|contains: 'openrouter.ai'
    condition: selection_chrome_headless
fields:

    - Image
    - CommandLine
    - ParentImage
    - User
falsepositives:

    - Developer workstations and CI runners that legitimately launch headless Chrome
    - Applications with a business reason to call an LLM API
level: medium
---
title: VOLTA-AUTODOXER report file creation
id: 2b6d9e04-71a3-4c58-9f2e-5a0c8d1b7e46
status: experimental
description: Detects creation of VOLTA-AUTODOXER harvest log and AI analysis output files in the user profile.
author: Adverse Trace
date: 2026-10-31
references:

    - https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:

            - '\volta_debug.txt'
            - '\Identity_Report.txt'
            - '\AI_Analysis.txt'
            - '\volta_dox.zip'
    condition: selection
fields:

    - TargetFilename
    - Image
    - User
falsepositives:

    - Unlikely
level: high

7. Sources

• Cisco Talos, "Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer", https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/, 2026-10-31.

8. Adverse Trace position

Adverse Trace assesses this as a credential and session theft threat with a post-theft triage layer, not an exploitation threat: no CVE is associated with the item, no exploitation state is recorded, and the implant's value to an operator comes from what it steals from an endpoint rather than from a software flaw. The attribution name VOLTA-AUTODOXER is unconfirmed; it is the malware's self-assigned label, no MITRE ATT&CK profile exists for it, and the builder and commodity-sale reading rests on a single vendor's inference from a six-slot configuration template. Client impact for EMEA financial services is account takeover and fraud risk concentrated in staff and contractor endpoints that hold Microsoft OAuth tokens, SSH and cloud-provider keys, Slack sessions and browser-stored payment cards, and the LLM stage raises the risk by telling a low-sophistication buyer which stolen identity to pursue first. We will monitor for further reporting on the initial access vector, which this source does not establish, and for corroboration of the builder model from a second vendor; until then, clients should treat the file and behavioural indicators in §5 as single-sourced and verify them against their own telemetry before enforcing blocks.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.