Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

What it is

VOLTA (self-named "VOLTA-AUTODOXER") is a self-deleting Windows infostealer, surfaced through the CAIRN research effort, that sends stolen data to an LLM via OpenRouter. The model ranks the victim's assets in a "WHAT THEY'RE WORTH" section with low, medium or high monetization tiers. A "THEIR OPSEC" section rates the victim's security posture and password hygiene. Talos describes the model's role as the operator's triage analyst.

How it works

Collection covers browser passwords, cookies and cards, wallets, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud keys, and Wi-Fi profiles (via WlanGetProfileList). An embedded cracker runs against wallet vaults and logs a WALLET VAULTS CRACKED line.

A live enrichment pass then reuses stolen sessions:

• Gmail is searched for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address.
• Uber Eats and DoorDash order history is pulled.
• The Discord token enriches the account profile.
• Roblox inventory is valued through a Rolimons lookup.

The result is written locally to Identity_Report.txt, sent as JSON to OpenRouter with the system prompt, and the reply is saved as AI_Analysis.txt. Both files leave in volta_dox.zip. The inference call goes out over the victim's own network connection.

The prompt asks for "a forensic intelligence analyst drafting a target assessment" with citations, and uses temperature 0.2. It also asks the model to link names, addresses or universities to password patterns. VOLTA scans replies for refusal phrases such as "I can't" or "I'm not able", then tries up to three models in turn (Claude, Kimi, Gemini). Without an API key it runs without the LLM stage.

flowchart TD
    A[Harvest + live enrichment] --> B[POST bundle to OpenRouter]
    B --> C{Refusal phrase?}
    C -- no --> D[AI_Analysis.txt]
    C -- yes --> E[Next model in chain]
    E --> C
    D --> F[volta_dox.zip to Telegram]

Preconditions / Affected

Windows hosts running Chromium-based browsers. Much of the token theft depends on bypassing Chrome App-Bound Encryption (ABE). Talos does not name affected versions.

What to do

• Use application control to restrict which processes may launch Chrome with --headless. Talos says this blocks the ABE decryption path entirely.
• At minimum, alert on Chrome launched with --headless from any process outside a known developer set.
• Store credentials in hardware-backed stores.
• After a suspected infection, preserve %APPDATA%\volta_debug.txt before anything else. It is a timestamped harvest log showing what was collected and whether the LLM call succeeded.
• Revoke potentially compromised tokens and change passwords.
• If a wallet seed phrase sat in plaintext on disk, treat the wallet as fully compromised. Move funds to a new wallet with a seed generated on an air-gapped device.

Caveats

The builder model is Talos's inference: the template has six swappable slots (Telegram channel, API keys, settings) filled at build time. The embedded keys are encrypted with SHA-256 of two constants in the same binary, so anyone reversing a sample can recover them. All observed endpoints are third-party services and there is no actor-owned infrastructure, so blocking is limited to those services. The page gives no hashes, domains or detection queries beyond the --headless rule.