Infostealer lets Claude and other LLMs rank victims by value

What this is about

Cisco Talos security researchers have described a new piece of malware that calls itself "VOLTA-AUTODOXER." It is an infostealer for Windows: a program that steals credentials and other data from a computer. What's new is that the malware doesn't just hand over the loot. It sends it to a large language model (LLM), which is asked to judge which of the victim's data is easiest to turn into money. It was found through CAIRN, a research initiative Talos uses to track down hacking tools with AI components. Wired also reported on it exclusively, according to mezha.net.

What VOLTA steals

According to Talos, the stealer is mature and collects broadly:

• Passwords, cookies and saved payment cards from Chromium browsers, plus Firefox, Thunderbird and Outlook profiles
• Seed phrases for crypto wallets (the "recovery words"); a built-in cracker breaks into wallet vaults directly on the machine
• Sessions from Discord, Telegram, Steam, Battle.net and Roblox, Slack workspaces, and Microsoft OAuth tokens
• SSH and cloud keys (gcloud, OpenVPN, Hide.me), all saved Wi-Fi passwords, and screenshots

According to Wired, the selection looks tailored to younger, very online users.

Enriching the profile with stolen sessions

The second phase is what sets it apart. Using the stolen access, VOLTA enriches the victim's profile. It searches the Gmail inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address. It pulls order histories from Uber Eats and DoorDash, fills in Discord profiles via the token, and values Roblox inventories live through Rolimons. The result is first saved locally as "Identity_Report.txt." It contains things like location and address, employer, estimated birth year, the last four digits of cards, author metadata from documents, and signs of iPhone backups.

The AI step

The package is sent as JSON to OpenRouter, a service that routes requests to many AI providers. The system prompt (about 240 words, according to Wired) tells the model to act as a "forensic intelligence analyst" and write a target assessment. It asks for a short summary, a "WHAT THEY'RE WORTH" section ranking assets by how easily they can be exploited (low/medium/high), and a "THEIR OPSEC" section on the victim's security posture and password hygiene. The model is supposed to "connect dots across fields," for example by checking whether the Wi-Fi password matches the victim's last name. The instruction reads: "Go deep, not wide... Be blunt, specific, accurate."

The response is saved as "AI_Analysis.txt," and both files are exfiltrated together as "volta_dox.zip." The call goes out over the victim's own network connection. VOLTA scans responses for stock phrases such as "I can't" or "I'm not able" and then moves on to the next model. Talos sees this as proof that the operators deliberately expect refusals. According to Talos researcher Ryan Fetterman, the prompt is also worded so that it doesn't look openly malicious. Without an API key, the malware still runs, just without the AI step.

Distribution and infrastructure

Instead of hard-coding the Telegram channel, API key and settings, VOLTA uses a template with six swappable slots. Talos concludes this points to a builder model: the author sells access, the customer supplies their own values, and a separate binary is generated for each order. The credentials are encrypted, but the key (a SHA-256 of two constants in the same program) offers little protection. All observed endpoints belong to third parties, and the attackers have no infrastructure of their own. According to Wired, Fetterman suspects the software is meant to be sold to multiple attackers. Talos has not tracked whether VOLTA has been used in the wild. The sample was first seen on October 11, 2026.

Countermeasures

Much of it relies on workarounds for Chrome's App-Bound Encryption (ABE). Talos recommends using application control to restrict which processes may launch Chrome with --headless, or at least alerting when unknown processes do so. Credentials should be kept in hardware-backed storage. If you suspect an infection: the executable deletes itself, but you should preserve the log file "%APPDATA%\volta_debug.txt," because it shows what was taken and whether the LLM call succeeded. Then revoke tokens and change passwords. If a wallet seed was sitting on disk in plain text, treat the wallet as fully compromised; move your funds to a new wallet with a seed generated on an offline device.

A related case: the Android malware DevilNFC

Another source describes, also with an AI angle, the Android malware DevilNFC (analyzed by Cleafy). It carries out NFC relay attacks on bank customers in Europe and Latin America and locks victims into a fake banking screen using kiosk mode. Cleafy sees signs of AI-assisted development in DevilNFC and the NFCMultiPay family, such as over-engineered phishing templates and typical LLM logs with emojis. It's a different story from VOLTA, but it shows the same trend.

Why it matters

Talos calls this "effort displacement." The AI doesn't speed up the technical work. It replaces the step that needs the most human attention, which here is sifting through the loot. Talos sees the same pattern in CLOSEDQUORUM. Faster triage can help attackers use tokens before they expire or before passwords are changed. Fetterman calls it "interesting and concerning" because advanced capabilities become within reach of less skilled attackers. It remains unclear how widespread VOLTA is and whether model providers block such requests. That Claude Opus 4.6 is the default only shows how the malware is configured, not that the model actually performs the task. In fact, the refusal chain suggests the authors expect the opposite. Wired also points to CrowdStrike, which says it has observed four hacking groups using AI tools.