Infostealers have always had a sorting problem. They grab everything (passwords, cookies, wallets, tokens) and then someone has to dig through millions of logs to find the valuable ones. Cisco Talos just documented a stealer that outsources the digging to a large language model.
What VOLTA Does
Talos calls it VOLTA (also VOLTA-AUTODOXER), a self-deleting Windows infostealer. The stealing part is standard: browser passwords, cookies and payment cards, crypto wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud keys, Wi-Fi passwords, and screenshots.
The new part comes next:
- It builds a dossier. VOLTA packages the loot into an identity report, then uses the stolen sessions to enrich it: searching Gmail for merchant receipts to confirm a home address, and pulling food delivery order history.
- It asks an LLM for an appraisal. The report goes to OpenRouter with a system prompt casting the model as "a forensic intelligence analyst drafting a target assessment." The output includes a "WHAT THEY'RE WORTH" section ranking the victim's assets and a "THEIR OPSEC" section grading their security habits.
- It expects refusals. The default model is Anthropic's Claude Opus 4.6. If the reply contains refusal phrases like "I can't," VOLTA falls back to Moonshot's Kimi K2, then Google's Gemini 2.5 Flash. Talos didn't report seeing a refusal happen. It notes the fallback chain implies the author expected to hit guardrails.
- It's built to be sold. Talos describes a builder with six slots filled at build time, including a Telegram channel for exfiltration and API keys, which suggests a kit or per-customer builds.
Why This Matters
The AI isn't stealing anything here. The stealer already did that. The AI is doing triage, the job that used to need a person with time and judgment. That means the operator spends their effort on the victims most worth targeting, and the follow-on attack (account takeover, fraud, extortion, a targeted phish at your workplace) arrives faster and better informed.
Two other details I'd underline. First, the guardrail story: the author treats model refusals as a routing problem and just tries the next model. Second, the enrichment step only works because stolen session cookies get you straight into a live Gmail account. Session theft keeps being the real prize.
What To Do
- Treat infostealer infections as identity incidents. Revoke sessions and tokens, not just passwords. A password reset does nothing about a cookie that's already been stolen.
- Follow Talos's specific detection advice. Restrict and alert on unknown processes launching Chrome with
--headless, which VOLTA uses for its cookie decryption path. - Use hardware-backed credentials and phishing-resistant MFA where you can, and shorten session lifetimes for sensitive apps.
- Keep secrets off endpoints. SSH keys, cloud keys and plaintext seed phrases on a laptop are exactly what this family harvests.
- Watch for LLM API traffic from unexpected processes. A random binary calling an AI gateway is a signal worth catching.
- If you're hit, Talos says to preserve
%APPDATA%\volta_debug.txt, which logs what was collected and whether the AI call succeeded.
Bottom Line
Attackers already had your data. Now they have an analyst that never sleeps deciding what you're worth. The defense hasn't changed, but the urgency has: kill stolen sessions fast and keep the valuable stuff off the endpoint.
Sources: Cisco Talos: Appraisal by AI, model-driven victim prioritization in the VOLTA infostealer and The Hacker News