Cisco Talos details VOLTA, an infostealer that asks an LLM which victims are worth pursuing

Cisco Talos researcher Ryan Fetterman has described a Windows infostealer that hands the job of sorting its loot to a large language model. In an October 31 post, Talos analyses VOLTA, or VOLTA-AUTODOXER, found through its CAIRN project for hunting AI-integrated malware. After a broad theft pass, the malware sends a structured profile of the victim to an LLM and gets back an assessment of which assets are most worth monetizing.

What it collects and how the AI step works

VOLTA takes browser passwords, cookies and saved payment cards, data from messaging and gaming accounts, SSH keys, VPN and cloud configuration files and saved Wi-Fi passwords, and it tries to crack cryptocurrency wallet vaults. It then reuses stolen sessions to enrich the profile, for example by searching Gmail for retail and delivery receipts to confirm a home address and by pulling food-delivery order history.

That evidence bundle goes to OpenRouter's chat completions API. The default model is anthropic/claude-opus-4.6; if the response contains refusal phrases, VOLTA retries with moonshotai/kimi-k2 and then google/gemini-2.5-flash. Talos reads this fallback chain as a sign that the author expected models to refuse. The prompt casts the model as a forensic analyst writing a target assessment, and the output ranks the victim's valuables by monetization potential in low, medium and high tiers, alongside a judgement of the person's security habits and password hygiene.

Builder model and defences

The code uses a template with six slots, such as the Telegram channel and API keys, filled in at build time. Talos suggests this points to a builder service in which a seller produces a custom binary for each buyer. Talos saw only third-party services, no attacker-owned infrastructure, and names no actor.

Talos recommends application control that blocks or alerts on Chrome being launched in headless mode by unknown processes, as well as hardware-backed credential storage. After an infection, it advises keeping the malware's debug log, revoking potentially exposed tokens, changing passwords and moving funds out of any wallet whose seed phrase was stored in plain text.

Why it matters

Talos frames the AI component as effort displacement: it does not make theft faster or larger, but replaces the analyst work of triaging stolen data. The post describes the shift as the difference between "a wide net and a wide net that sorts itself". Neither the Talos post nor Unite.AI's summary of it includes any statement from OpenRouter or Anthropic about the misuse of their services.