VOLTA uses LLMs to rank victims by the value of stolen data
Cisco Talos says the VOLTA infostealer sends stolen credentials and session data to LLMs to rank a victim’s most monetizable assets.
AT A GLANCE
Key points
- VOLTA adds an optional LLM-based triage stage after data theft.
- The malware uses Claude Opus 4.6 by default and falls back to Kimi K2 and Gemini 2.5 Flash.
- The model ranks stolen assets and produces a cited target assessment.
What is changing?
Cisco Talos identified an optional AI layer in a Windows infostealer that calls itself “VOLTA-AUTODOXER.” After collecting browser passwords, session cookies, payment cards, cryptocurrency wallets, OAuth tokens and cloud keys, the malware builds a structured evidence bundle about the victim.
The bundle is sent to OpenRouter through the victim’s own network connection. Talos says Claude Opus 4.6 is the default model, with Kimi K2 and Gemini 2.5 Flash used in sequence when a model refuses or fails. The prompt asks for a cited target dossier that ranks assets by monetization value and assesses the victim’s security habits.
VOLTA’s AI layer does not steal the data itself; it prioritizes already stolen information for the operator. Talos recommends restricting unexpected headless Chrome launches, revoking tokens and changing passwords after a suspected compromise, and preserving the surviving volta_debug.txt log.
Explore the original sources
Source date: 31 October 2026.
Published by AI Radar: 31 Oct 2026, 20:02 (Istanbul, UTC+3).
FOLLOW THE TOPIC
Topics and tags
Share your discovery.
Send this story to a friend.
Reader comments
What do you think about this development? Share your experience or question. Comments are published after editorial approval.
Your name/nickname and comment become public if approved. Read: Privacy notice.
Loading comments…