Cisco Talos has documented a Windows infostealer called VOLTA-AUTODOXER that, after copying a victim’s passwords, wallets and sessions, sends the haul to a commercial AI model with one instruction: rank what the person’s assets are worth to a criminal. The model returns a low, medium or high value tier and a verdict on the victim’s security habits. Talos published the analysis on 31 October, and Help Net Security covered it on 2 November.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The malware deletes itself after it runs, and every endpoint it contacts belongs to a third party, so there is no attacker-owned server for investigators to seize. That design pushes the hard work of triage, usually done by a human operator reading through logs, onto a commercial model reached through an API call, so the victim is appraised within moments of the theft rather than after a human has worked through the logs.
Ryan Fetterman of Cisco Talos described the idea in Help Net Security’s coverage as a new one in cybercrime: cast a wide net, steal everything and let AI sort out the specifics. He said VOLTA builds a structured evidence bundle about the person behind the machine, and that the broader pattern is to find the step needing the most sustained human attention and replace it with a model call.
What VOLTA-AUTODOXER takes from a Windows machine
The haul is broad. It includes browser passwords, cookies and saved payment cards, cryptocurrency wallet seed phrases that it cracks inline, Microsoft OAuth tokens, SSH keys and cloud provider keys, and Discord, Telegram, Steam and Roblox sessions. It also pulls every saved Wi-Fi password in plaintext.
Stolen sessions then feed a second stage. According to the Talos analysis, the malware searches Gmail for purchase receipts to confirm a home address, retrieves food-delivery order history and enriches Discord accounts through the stolen token. The resulting bundle can hold geolocation, address, employer, an inferred birth year, the last four digits of cards, Slack workspaces, document metadata, iPhone backup indicators and a valuation of the victim’s Roblox account.
The appraisal step and its three-model fallback
The data is assembled locally into a file named Identity_Report.txt, serialized as JSON and posted through the OpenRouter service with a system prompt that tells the model to act as a forensic intelligence analyst drafting a target assessment. The default model is Anthropic’s Claude Opus 4.6. Each reply is checked for refusal wording, and if the model declines, the job passes to Moonshot AI’s Kimi K2 and then to Google’s Gemini 2.5 Flash, all at a temperature of 0.2.
The answer is saved as AI_Analysis.txt, with a section on what the victim is worth and another on their security practices, and the prompt asks for a blunt, specific and accurate result rather than a broad one. Both files leave the machine together in an archive called volta_dox.zip. Fetterman said the chain of fallbacks suggests the operator expects to run into refusals, and the order of the three models shows how the author planned around them.
Talos suspects a builder model, in which the criminal who wrote the tool sells it as a service. Settings such as a Telegram channel and API keys fill six template slots at build time, results can be delivered to the buyer’s Telegram inbox, and the author sells access while each customer supplies their own values and receives a custom binary. That arrangement lowers the skill needed to run a campaign, since a buyer only has to supply a Telegram channel and API keys.
CAIRN, the research effort behind the find
Talos found the sample through CAIRN, an open-source framework it released in September to hunt for malware that uses AI. As Techzine reported, CAIRN works from metadata that VirusTotal already exposes, looking for traces such as prompt templates, AI provider endpoints and API keys, without downloading or running samples. Talos itself calls it a research project rather than a ready-made threat indicator, and definitive verdicts still need reverse engineering.
The first public result was an implant named CLOSEDQUORUM, which asked a panel of commercial models to vote on its next step, as Help Net Security noted in September. That sample carried placeholder API keys and was never seen attacking a live target. VOLTA, with working fallbacks and a defined output, looks closer to a finished product.
Defenses Talos recommends after an infection
Talos advises restricting which processes may launch Chrome with the headless flag and alerting on such launches from unknown programs, since that path is used to bypass App-Bound Encryption, the Chrome protection for cookies on Windows, a subject the Chrome security team’s 2024 post addresses. It also recommends storing credentials in hardware-backed stores. After a compromise, responders should keep the VOLTA debug log from the APPDATA folder, revoke exposed tokens and change passwords. Any wallet whose seed phrase sat in plaintext on disk should be treated as compromised, with funds moved to a new wallet generated on an air-gapped device.
Talos has not published a count of victims or a date when the malware first appeared in the wild, so how widely VOLTA is deployed remains unknown. Whether the three AI providers named in its configuration have taken action against the keys it uses is also not stated in the reporting.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
