Cisco Talos details on the LLM victim classification phase of VOLTA Infostealer – Unite.AI

Cisco Talos researcher Ryan Fetterman on October 31, 2026 published an analysis of VOLTA-AUTODOXER, a self-deleting Windows infostealer that follows an extensive credential theft step with an extensive language model step designed to classify each victim’s monetizable assets.

Talos describes VOLTA as a mature stealer implant with an optional AI integration layer and says that every observed endpoint is controlled by a third party, without any infrastructure owned by the attacker. In the Talos evaluation, what is new in the AI ​​phase is that the model functions as an intelligence analyst on behalf of the operator rather than supporting a traditional malware capability, converting a raw credential log into a prioritized dossier of the victim’s monetizable assets supported by citations.

The malware emerged thanks to Talos’ CAIRN research effort. Talos released and open-sourced CAIRN, Cognitive Artifact Intelligence Research Network, on September 22, 2026 as a toolkit for searching, classifying, and tracking AI-embedded malware through metadata artifacts such as embedded prompts, provider endpoints, and API keys, without downloading or running the underlying binaries. Talos said at the time of release that it will share its initial findings over time, starting with CLOSEDQUORUM, an implant described as a fully autonomous multi-model consensus orchestrator without a human operator.

Collection and enrichment of the session

A single VOLTA pass extracts browser credentials, cookies, and payment cards saved on Chromium-based browsers, along with Firefox and Thunderbird data, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, Microsoft OAuth tokens, SSH and cloud provider configuration files for gcloud, OpenVPN, and Hide.me, Wi-Fi profiles, and screenshots. Instead of simply copying cryptocurrency wallets, the thief runs an embedded cracker against the wallet vault during the same step and records the result on a WALLET VAULTS CRACKED line in their report. A direct call to WlanGetProfileList downloads every Wi-Fi password saved on the host in plain text.

A live enrichment pass then reuses the stolen sessions. With the victim’s authenticated Gmail tokens, VOLTA searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to confirm a home address. It directly extracts Uber Eats and DoorDash order history, enriches the victim’s Discord profile through the stolen token, and evaluates Roblox inventory through a real-time search on Rolimons.com. The collected material is assembled locally into a structured evidence package containing geolocation and home address, employer and employer domain, inferred year of birth, last 4 digits of the card, Slack workspaces, document authorship metadata, and iPhone backup indicators, then saved as Identity_Report.txt and serialized as JSON.

The evaluation returned by the model is saved as AI_Analysis.txt, and exfiltration can occur in three phased archives: volta_log.zip after the stealer execution, volta_dox.zip after the AI ​​call, and volta_doxnet.zip if network enrichment yields anything.

The classification phase of OpenRouter

The serialized packet is published to the OpenRouter chat completion endpoint via a system prompt that instructs the model to act as “a forensic intelligence analyst drafting a target assessment.” The required output includes a HOW MUCH WORTH section that ranks the victim’s valuables by monetization value into low, medium, and high tiers, and a THEIR OPSEC section that rates the victim’s security level and password hygiene. The request also pushes the model to connect scattered data points, for example by linking a victim’s name, address, or university to patterns in their passwords. Talos notes that the model isn’t being asked so much to find data as to draw inferences that extend the value of what has already been scraped.

The hardcoded configuration uses antropic/claude-opus-4.6 as the default template, with a fallback chain of moonshotai/kimi-k2 and then google/gemini-2.5-flash, a temperature of 0.2, and manually assembled JSON requests without an SDK and a Mozilla/5.0 user agent. Talos says the low temperature suggests the operator is emphasizing accuracy and consistency, and describes the cascade as a pivot to smaller, more forgiving patterns when waste occurs.

VOLTA checks each model’s response for rejection phrases such as “I can’t” before moving to a chain of up to three models, and can be run completely without the LLM phase if no API key is present. The entire round trip of the inference is performed on the victim’s computer via the victim’s network connection; only subsequently is the result exfiltrated.

Manufacturer distribution and countermeasures

Instead of coding the Telegram channel, API keys, and settings, VOLTA is compiled from a template with six swappable slots filled in at build time. Talos says this indicates a build model where the author sells access, buyers provide their own values, and a custom binary code is compiled for each order. If this model is valid, the analysis notes, the AI ​​dossier is a commercial feature that allows a customer of any level of sophistication to receive classified target ratings in a Telegram inbox, rather than a feature created by the author for personal use. The slot credentials are encrypted with a derived key such as SHA-256 of two constants that are in the same binary, which Talos says provides no significant protection because anyone who reverses the file can recover them.

Much of VOLTA’s token theft depends on bypassing the encryption associated with the app in Chrome. Talos says that an application control policy that limits which processes can launch Chrome with the headless flag would completely block the decryption path, and at a minimum recommends alerting when Chrome is launched headless by an unexpected process, along with hardware-backed credential storage. After a compromise, Talos recommends preserving the volta_debug.txt file, a timestamped collection log that records exactly what was collected and whether the LLM call was successful, then revoking potentially compromised tokens and changing passwords. Any wallet whose seed phrase is found in plain text on disk should be treated as fully compromised, with the funds migrated to a new wallet whose seed is generated on an air-gapped device.

In Talos’ framework, the improvement made by the AI ​​layer is effort shift rather than speed or scale, the same underlying logic identified by Talos in CLOSEDQUORUM, applied to a different phase of the operation. As the integration of AI into malware matures, the analysis concludes, rejection resilience could become a standard design requirement.

Talos lists the analyzed sample as a PE32+ x86-64 binary with SHA-256 hash 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, observed with the file names 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe, with a PE timestamp of August 17, 2026 and first seen at 12:46 UTC on October 11, 2026.