VOLTA infostealer asks Claude which victims to rob first

Picture a burglar who, after emptying your drawers, sits down at your kitchen table and asks a chatbot which of your belongings will fetch the best price. That’s the VOLTA infostealer in one sentence. And no, I’m not exaggerating for effect.

Cisco Talos published a teardown of the thing on October 31, under the catchy name VOLTA-AUTODOXER. Underneath, it’s a pretty standard Windows stealer: browser passwords, cookies, saved cards, Discord and Telegram sessions, Steam and Battle.net logins, SSH keys, cloud credentials, every Wi-Fi password you ever saved (in plaintext, thanks WlanGetProfileList), plus a few screenshots for good measure. It even runs a cracker against your crypto wallet vault inline and proudly writes “WALLET VAULTS CRACKED” in its own report.

So far, so 2024. The twist is what happens next.

VOLTA infostealer: an AI analyst for crooks

Once the loot is bundled, VOLTA ships it off to OpenRouter and asks a large language model to play “forensic intelligence analyst drafting a target assessment”. The default model is Claude Opus 4.6, temperature 0.2 so the answers stay consistent. The prompt demands sections like “WHAT THEY’RE WORTH”, with your assets ranked low, medium or high by how easily they can be cashed out, and “THEIR OPSEC”, a little essay on how sloppy your password hygiene is. It even nudges the model to connect your name, address or university to the patterns in your passwords.

The result lands in the operator’s Telegram inbox as a neat, citation-backed dossier. As Talos puts it, “the model is the operator’s triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.” In other words, the stealer does the stealing, the AI does the thinking, and the human just picks the juiciest victim off the top of the list.

When Claude says no, VOLTA asks Kimi

Here’s my favourite detail. The malware author clearly expected the big-name models to push back. So after every response, VOLTA scans for phrases like “I can’t” or “I’m not able”, and if it finds one, it quietly moves down a fallback chain: Kimi K2 first, then Gemini 2.5 Flash. Talos describes it as pivoting to “a few, smaller, and more permissive models”. No API key at all? Fine, the AI stage is skipped and the stealer runs anyway.

That’s the uncomfortable part. Safety refusals in one model are only as useful as the least cautious model one API call away. The crooks didn’t jailbreak anything; they just added a retry loop.

And the enrichment goes further than I’d like. With your stolen Gmail session, VOLTA searches for Amazon, Uber Eats, DoorDash and PayPal receipts to confirm your home address. It pulls your food delivery history. It even values your Roblox inventory through a live Rolimons lookup. Your kid’s avatar skins are now a line item in a criminal’s spreadsheet.

How VOLTA hides, and what to do about it

There’s no attacker infrastructure to take down. Every endpoint is a legitimate third party: OpenRouter, Telegram, Gmail. The binary deletes itself after running, and it’s sold as a builder, with six configurable slots (Telegram channel, API keys, settings) baked in at compile time. Any customer, “of any level of sophistication”, gets ranked target assessments delivered to their phone. Talos first spotted a sample on October 11; the compile timestamp says August 17. It’s been out there for a while.

It isn’t the first time the AI-and-malware story has crossed my desk, and it rhymes with last week’s poisoned Claude Code extension: the tooling we love is exactly what makes attackers more efficient too.

What would I do? On a Windows box, the practical fix Talos suggests is to restrict which processes may launch Chrome with the --headless flag, since that’s how VOLTA bypasses Chrome’s App-Bound Encryption to grab tokens. Use hardware-backed credential storage where you can. And if you’ve been hit, don’t nuke everything right away: keep %APPDATA%\volta_debug.txt, which logs exactly what was taken, then revoke tokens, change passwords, and treat any wallet whose seed phrase lived on that disk as gone. Move the funds to a fresh wallet created on an air-gapped device.

The malware didn’t get smarter. It just hired an intern that never sleeps and never says no twice.