VOLTA Infostealer: The Windows Stealer That Asks an LLM to Rank Victims by Value

Cisco Talos published its analysis on 31 October 2026 of VOLTA, a self-deleting Windows infostealer with an optional second stage. After stealing credentials, sessions and cryptocurrency wallets, VOLTA can send a structured evidence bundle to a large language model and ask it to rank the victim’s assets by monetisation value. Talos calls VOLTA a “mature stealer implant with an optional AI-integration layer.” The Talos post documents code and design. In the text fetched for this article, it does not state whether VOLTA has been used in observed attacks, how many victims it reached, or whether any model answered or refused in practice.

VOLTA names itself “VOLTA-AUTODOXER” in the material Talos examined, and Talos says the sample surfaced through the CAIRN research effort. The first sample was first seen at 12:46 UTC on 11 October 2026. Talos lists its SHA256 as 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 and gives a PE timestamp of 20:35 on 17 August 2026.

What Talos Actually Documented

Talos states the finding directly: “VOLTA is a mature stealer implant with an optional AI-integration layer. After stealing credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to an LLM to rank the victim’s assets by monetization value.” The theft comes first. The language model does not carry out the theft; it receives material after theft and returns an assessment of value. The Talos page is dated Saturday, 31 October 2026, with no timezone stated. No spread claim appears in the primary text used here.

How the Theft Stage Works

VOLTA’s core function is familiar: credentials, sessions and cryptocurrency wallets. The stolen material is organised into a structured evidence bundle, which becomes the input to the optional AI stage. VOLTA is also self-deleting. Talos does not turn that property, in the fetched text, into a broader claim about detection or recovery, and this article does not add one.

On infrastructure, Talos is explicit: “All the observed endpoints for this malware are third-party controlled. There is no actor-owned infrastructure.” That wording is limited to observed endpoints. It names no operator and attributes VOLTA to no person or group. No attacker identity appears in the Talos text used here, and none is added.

volta-infostealer-1.jpg


Credit: Illustration created for INORYVA. Abstract Windows desktop and security visual; not a screenshot of VOLTA or a real infected system.

The pattern differs from the Cursor Claude Code extension malware case, which involved a tampered extension rather than a stealer that ranks stolen assets after theft.

How the AI Ranking Stage Works

The AI stage is optional. Talos says VOLTA has “the ability to run without the LLM stage altogether if no key is present.” This article keeps Talos’s wording, “no key”, rather than substituting “no API key”.

When the stage runs, Talos describes a defined sequence. The bundle is serialised and POSTed to OpenRouter under a system prompt instructing the model to act as “a forensic intelligence analyst drafting a target assessment”. Talos’s endpoint table lists the address in defanged form as https://openrouter[.]ai/api/v1/chat/completions. Talos does not publish, in the fetched text, a full prompt or a model response, and this article does not reconstruct either. The output Talos describes is a ranking by monetisation value: a sorting step after collection, concerned with value to the operator rather than the technical severity of the theft.

The Model Chain, Refusal Checks and Temperature

Talos lists a default model and a fallback chain. The default is anthropic/claude-opus-4.6 (Claude Opus 4.6). The fallback chain is moonshotai/kimi-k2 (Kimi K2), then google/gemini-2.5-flash (Gemini 2.5 Flash). The order is therefore Claude Opus 4.6 first, Kimi K2 second and Gemini 2.5 Flash third. Talos presents this as a chain of up to three models, not as a claim that each model was used in a particular incident.

VOLTA checks responses for refusal language before moving on. Talos describes the code as “checking each response for phrases like ‘I can’t’ or ‘I’m not able,’ before passing on to a chain of up to three models”. If a model refuses to perform the target assessment, Talos says, “VOLTA fails over to a three-model chain, implying a direct engineering effort and expectation of hitting model guardrails.” That is Talos’s reading of the design. It is not evidence that a refusal happened, that a guardrail was bypassed, or that any named model complied. The code anticipates refusal; anticipation and occurrence are different facts, and only anticipation is documented here.

volta-infostealer-2.jpg


Credit: Illustration created for INORYVA. Abstract ranking and prioritisation visual with no readable text; not a screenshot of a model response or stolen data.

Talos also records a hardcoded temperature of 0.2, described in its table as “deterministic, consistent output”. Talos adds: “The low hardcoded temperature value (0.2) suggests the attacker is emphasizing accuracy and consistency.” Talos presents it as a suggestion about intent drawn from the code setting, not as proof that the setting produced accurate assessments in use.

VOLTA sits on the other side of the AI-and-security line from the Bitcoin Core vulnerabilities AI scan, where AI was used to find flaws rather than to prioritise stolen data.

What the Design Suggests, and What It Does Not Prove

The clearest suggestion is preparation for refusal. A single model call would be simpler. A three-model chain, combined with a refusal-phrase check, shows the builder expected at least one model to decline the assessment task. The design shows what the builder prepared for, not what happened next.

The second suggestion concerns reuse. Talos writes: “This suggests it’s a builder model”, and adds the conditional form, “If VOLTA is indeed a commoditized malware…” Both are conditional in Talos’s wording. This article therefore does not state that VOLTA is a builder product or has been commoditised. At most, Talos raises the possibility and leaves it unconfirmed.

The trust question is narrower than some model-safety debates. The issue is not a model acting on its own, but malware code calling a model through a third-party routing service and asking for a ranking. The Claude rogue behaviour report concerned reported model behaviour, rather than malware code calling a model in this way.

volta-infostealer-3.jpg


Credit: Illustration created for INORYVA. Abstract network and API-request visual with no real endpoints shown; not a diagram of VOLTA infrastructure.

What Is Not Known

Several basic questions have no answer in the Talos text fetched for this article. There is no victim count, no named victim organisation and no infection count. There is no evidence in that text that Claude Opus 4.6, Kimi K2 or Gemini 2.5 Flash complied, partly complied or refused in testing or deployment. There is no attribution to an attacker, and no motive stated beyond what the design implies about ranking stolen assets by value.

The Talos post also contains, in the fetched text, no statement either way about real-world use, and this article adds none. The absence of a use claim is not proof that VOLTA was never used, or that it was. No removal or cleanup steps are offered here: the Talos text used does not provide a verified set of defensive steps to reproduce.

Key Takeaways

  • Cisco Talos analysed VOLTA, self-named VOLTA-AUTODOXER, a self-deleting Windows infostealer first seen on 11 October 2026, in a post dated 31 October 2026.
  • After stealing credentials, sessions and cryptocurrency wallets, VOLTA can send a structured evidence bundle via OpenRouter to an LLM to rank assets by monetisation value.
  • The default model is Claude Opus 4.6, with fallback to Kimi K2 and then Gemini 2.5 Flash; the code checks for refusal phrases and the temperature is hardcoded at 0.2.
  • The LLM stage is optional and can be skipped if no key is present; Talos found no actor-owned infrastructure among the observed endpoints.
  • No victim count, attribution, or evidence of model compliance or refusal is stated in the Talos post used here, and the builder suggestion remains conditional in Talos’s wording.

Conclusion

VOLTA matters because it shows a stealer treating a language model as a sorting step after theft. Talos documents the addition as code: a structured bundle, an OpenRouter call, a forensic-analyst prompt, a three-model chain, a refusal check and a low temperature setting. What the post does not document is use, scale or outcome. Until independent evidence confirms how, or whether, this design has been run beyond the sample Talos analysed, VOLTA should be described for what the primary source shows: a mature stealer with an optional AI layer built to rank victims by value.

Sources

 

Comments

Post a Comment