VOLTA infostealer uses LLMs to rank victims by financial value

1. Executive summary

Cisco Talos has documented a Windows infostealer it names VOLTA-AUTODOXER (VOLTA) that, after harvesting credentials, cookies, payment cards, cryptocurrency wallet seeds, sessions and cloud keys, builds a structured profile of the victim and sends it to a large language model to rank the victim's assets by monetization value. The malware posts the bundle to OpenRouter, defaulting to anthropic/claude-opus-4.6 with a fallback chain of moonshotai/kimi-k2 then google/gemini-2.5-flash, and asks the model to produce a "WHAT THEY'RE WORTH" ranking and an assessment of the victim's security posture. No CVE has been assigned and no exploitation of a specific vulnerability is described; the item is a malware capability report, single-sourced to Talos. For EMEA financial services the concern is targeted follow-on fraud and account takeover against staff and customers whose credentials and session tokens are stolen, not a patchable defect. Adverse Trace assesses the risk to a given client as dependent on whether VOLTA is present in its estate, which public reporting does not establish.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The source describes VOLTA's post-theft workflow in detail but does not state the initial access vector, the delivery mechanism, or the affected Windows versions. Those are not given in public reporting. The confirmed chain, as reported by Talos, is:

1. Execution on a Windows host. The stealer is described as self-deleting. How it is delivered and launched is not stated.
2. Credential and session harvesting in a single pass: browser passwords, cookies and saved payment cards across Chromium-based browsers; Firefox and Thunderbird; Outlook profiles; Slack workspaces; Steam and Battle.net sessions; Discord tokens; Telegram sessions; Roblox accounts; SSH and cloud-provider config files (gcloud, OpenVPN, Hide.me); cryptocurrency wallets; saved Wi-Fi passwords; and screenshots.
3. Inline cryptocurrency wallet cracking. VOLTA runs an embedded cracker against wallet vaults and writes the result to a WALLET VAULTS CRACKED line in its own report.
4. Evidence-bundle construction. The malware assembles a structured profile containing geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation.
5. Enrichment using stolen session access: searching the victim's Gmail for purchase receipts to corroborate a home address, pulling UberEats and DoorDash order history, and enriching Discord accounts via the stolen token.
6. LLM profiling. The bundle is serialized and POSTed to OpenRouter at https://openrouter[.]ai/api/v1/chat/completions under a system prompt instructing the model to act as "a forensic intelligence analyst drafting a target assessment." The required output includes a section titled "WHAT THEY'RE WORTH" ranking valuables by monetization with a low/medium/high tier, and a section on "THEIR OPSEC" assessing security posture and password hygiene. The prompt also asks the model to connect sparse data points, for example linking the victim's names, addresses or universities to patterns in their passwords.

The model configuration is hardcoded: default model anthropic/claude-opus-4.6, fallback chain moonshotai/kimi-k2 then google/gemini-2.5-flash, temperature 0.2, hand-assembled JSON with no SDK and User-Agent Mozilla/5.0. VOLTA checks each response for refusal phrases such as "I can't" or "I'm not able," then passes to the next model in a chain of up to three. Talos reads the low temperature as an attempt at consistent output and the fallback chain as anticipating refusals, pivoting to smaller, more permissive models.

Persistence, privilege escalation, lateral movement and command-and-control are not described in the source. The only network destination named is the OpenRouter API endpoint. Data exfiltration beyond the LLM POST is not detailed.

This entire account rests on a single source, the Cisco Talos report, surfaced through the CAIRN research effort. The model names, endpoint and prompt text are single-sourced; verify before building enforcement around them.

4. Mitigation & containment

No fixed release is named in public reporting because VOLTA is malware, not a vulnerable product. The steps below address detection and containment of the stealer and the exposure of the data it targets.

P1 within 24h

• Hunt for outbound HTTPS POSTs to openrouter[.]ai/api/v1/chat/completions from endpoints that have no business reason to call an LLM API. Treat any such traffic from a finance, treasury or payments workstation as a compromise indicator.
• Search proxy and DNS logs for the string openrouter[.]ai and alert on first-seen hosts.
• Where a host is confirmed or suspected compromised, isolate it, then force credential resets for every account whose tokens or passwords the host could hold: browser-saved passwords, Microsoft OAuth tokens, Slack, Discord, Telegram, Steam, Battle.net, Roblox, SSH keys and cloud-provider credentials (gcloud, OpenVPN, Hide.me).
• Revoke active sessions and refresh tokens, not just passwords. VOLTA steals session material, so a password change alone does not evict the attacker.
• For any host holding cryptocurrency wallets, assume the vaults were attacked inline and move funds from a clean device.

P2 within 72h

• Block the OpenRouter endpoint at the egress proxy for user endpoints unless an approved application depends on it. This is a blunt control; scope it to user VLANs rather than servers.
• Audit which staff hold saved payment cards in browsers and which store cloud or SSH keys on general-purpose workstations. Remove saved card data from browsers by policy.
• Review mailbox and SaaS audit logs for the enrichment behaviours: Gmail searches for purchase receipts, and Discord token use from unfamiliar locations.

P3 within 7 days

• Reduce the data VOLTA monetizes: enforce password-manager use over browser storage, move SSH and cloud keys to hardware tokens or a secrets manager, and remove saved Wi-Fi credentials from laptops that travel.
• Add the detection rules in §6 to EDR and SIEM and tune against a week of production traffic.

5. Indicators of compromise

The source gives no file hashes, no C2 domains beyond the legitimate OpenRouter API, and no file paths. OpenRouter is a legitimate public service, so it is described here as a behavioural indicator, not listed as a pivotable atomic indicator. There are no atomic indicators suitable for the copyable block.

Behavioural indicators

6. Detection

The source gives distinctive strings from the malware's own request and report, which support a YARA rule. The strings below are copied from the Talos report.

rule VOLTA_AUTODOXER_LLM_Profiler
{
    meta:
        author = "Adverse Trace"
        date = "2026-11-02"
        reference = "https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/"
        description = "Detects VOLTA-AUTODOXER strings tied to its LLM victim-profiling stage"
    strings:
        $ep = "openrouter.ai/api/v1/chat/completions" ascii wide
        $m1 = "anthropic/claude-opus-4.6" ascii wide
        $m2 = "moonshotai/kimi-k2" ascii wide
        $m3 = "google/gemini-2.5-flash" ascii wide
        $p1 = "WHAT THEY'RE WORTH" ascii wide
        $p2 = "THEIR OPSEC" ascii wide
        $p3 = "forensic intelligence analyst drafting a target assessment" ascii wide
        $wv = "WALLET VAULTS CRACKED" ascii wide
        $ua = "Mozilla/5.0" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (
            ($ep and 1 of ($m*)) or
            ($p1 and $p2) or
            $p3 or
            ($wv and $ua)
        )
}

A Sigma rule for the network behaviour, keyed on the OpenRouter endpoint:

title: Outbound POST to OpenRouter LLM API from User Endpoint
id: 8f3c2a10-7b41-4e2d-9c55-volta0001
status: experimental
description: Detects user endpoints posting to the OpenRouter chat completions API, consistent with VOLTA victim profiling
author: Adverse Trace
date: 2026/11/02
references:

    - https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/
logsource:
    category: proxy
detection:
    selection:
        cs-method: 'POST'
        r-dns|endswith: 'openrouter.ai'
        cs-uri|contains: '/api/v1/chat/completions'
    condition: selection
falsepositives:

    - Approved developer or research use of the OpenRouter API
level: medium

7. Sources

• Cisco Talos, "Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer," https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/
• The Hacker News, "New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value," https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html, 2026-11-02

8. Adverse Trace position

Adverse Trace assesses this as a malware capability report, not a vulnerability advisory: no CVE, no CVSS score and no CISA KEV entry apply, and the severity to a specific client depends on whether VOLTA is present in its estate, which public reporting does not establish. The capability that matters for financial services is the LLM-driven ranking of victims by monetizable assets, which turns a commodity credential haul into a prioritized target list for follow-on fraud and account takeover. The technical detail rests on a single source, Cisco Talos; the model names, endpoint and prompt text are single-sourced and should be verified before enforcement. We will track further reporting on VOLTA's delivery vector and any atomic indicators, and will issue an update if a second independent source corroborates the LLM workflow or names initial access. Clients should treat the P1 session-revocation steps as the priority, since stolen session tokens survive a password reset.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.