VOLTA Infostealer Uses an LLM to Rank Stolen Victim Assets

VOLTA-AUTODOXER is a self-deleting Windows infostealer that harvests credentials, sessions, cryptocurrency wallets, and other system data, then sends a structured evidence bundle to a large language model to rank the victim's assets by monetization value. The malware uses a multi-model fallback chain if a model refuses the target assessment. There is no attacker-owned infrastructure behind it.

What VOLTA Collects

In one pass, VOLTA can extract browser credentials, cookies, and saved payment cards across Chromium-based browsers. It also targets Firefox, Thunderbird, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, SSH and cloud-provider configuration files, Wi-Fi passwords, and screenshots. It runs an embedded cracker against cryptocurrency wallet vaults inline and records the result in its report.

AI-Powered Victim Profiling

After collection, VOLTA builds a structured evidence bundle containing geolocation, home address, employer and employer domain, inferred birth year, card last-four digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation. It enriches that bundle using stolen sessions, including Gmail purchase receipts, Uber Eats and DoorDash order history, Discord profile data, and Roblox inventory valuation. The bundle is serialized as JSON and sent to OpenRouter under a system prompt asking the model to act as a forensic intelligence analyst drafting a target assessment. The required output includes a section ranking valuables by monetization into low, medium, and high tiers, plus an assessment of the victim's security posture and password hygiene.

Model Fallback and Exfiltration

The default model is anthropic/claude-opus-4.6, with fallback to moonshotai/kimi-k2 and then google/gemini-2.5-flash. VOLTA checks responses for refusal phrases and uses a hardcoded temperature of 0.2. The inference runs through the victim's own network connection before results are exfiltrated. Output files can include volta_log.zip, volta_dox.zip, and volta_doxnet.zip depending on collection and enrichment results.

Countermeasures

Defenders can restrict which processes may launch Chrome with --headless to block the App-Bound Encryption bypass path. If compromise is suspected, users should preserve APPDATA%\volta_debug.txt, revoke potentially compromised tokens, change passwords, and treat any wallet with a plaintext seed phrase as fully compromised.

Sources: blog.talosintelligence.com