The VOLTA Windows infostealer is targeting personal computers to harvest sensitive files and credentials before querying Anthropic‘s Claude model to evaluate the financial worth of each victim, according to research published by Cisco Talos. The malware packages stolen records into an evidence dossier and requests an automated appraisal before deleting its executable from infected machines.
Key points
- The VOLTA malware steals system credentials, browser sessions, and personal records, then queries artificial intelligence models to rank the victim’s assets by cash-out potential.
- It routes prompt requests through OpenRouter to Anthropic‘s Claude Opus 4.6 by default, with automatic fallbacks to Moonshot AI and Google models if safety guardrails trigger a refusal.
- Operators receive a structured victim profile and AI assessment directly through Telegram without hosting custom command-and-control infrastructure.
- Defenders can mitigate the credential theft mechanism by restricting headless instances of Google Chrome that bypass App-Bound Encryption.
Automated appraisals on infected endpoints
Security researchers at Cisco Talos identified the malware, which identifies itself internally as VOLTA-AUTODOXER, operating as a commercial payload built for resale. Instead of forcing operators to sift manually through gigabytes of stolen logs, the software relies on commercial language models to triage each compromised computer.
Once executed on a Windows system, VOLTA collects data across local applications. It gathers browser cookies, stored passwords, saved payment cards, Microsoft OAuth tokens, and desktop screenshots. It also targets desktop email profiles from Mozilla Thunderbird and Microsoft Outlook, extracts cloud provider configurations, and copies Secure Shell keys.
Saved Wi-Fi network passwords are recovered in plaintext, while local cryptocurrency wallet vaults are targeted for inline cracking attempts. The tool also extracts authorship metadata from personal documents to map out the target’s identity, employer, and approximate age.
Rather than stopping at passive file collection, the infostealer actively queries active web sessions to enrich its dataset. Using stolen session cookies, it searches Gmail accounts for transaction receipts from Amazon, Walmart, PayPal, DoorDash, Grubhub, and Uber Eats to verify residential addresses. It inspects Discord accounts to gather profile details and queries public valuation services to calculate the resale price of inventory linked to Roblox accounts.
Routing stolen records through commercial models
After compiling the records into a structured local text file and serialising the data into JSON, VOLTA generates a prompt instructing an artificial intelligence model to act as a forensic intelligence analyst. As detailed in the Cisco Talos threat research, the prompt commands the model to be “blunt, specific, accurate” while reviewing the evidence bundle.
The system prompt asks the model to rate the victim’s suitability as a target, calculate potential payout values, and evaluate overall operational security posture, including password reuse habits. VOLTA sends this query over the victim’s own internet connection to OpenRouter, an aggregator that routes requests across multiple commercial artificial intelligence application programming interfaces.
By default, the software targets Claude Opus 4.6, an Anthropic model released in February. The malware hardcodes an inference temperature of 0.2. Setting a low temperature reduces output randomness, ensuring predictable, structured appraisals instead of open-ended conversational replies.
To counter safety filters that reject requests involving stolen personal information, VOLTA monitors API responses for standard refusal phrases or unusually short replies. If Claude declines the prompt, the code attempts the same analysis using Kimi K2 from Moonshot AI, followed by Gemini 2.5 Flash from Google. If all model requests fail or if the buyer does not supply an API key, the malware skips the analysis step entirely and packages the raw data.
Infrastructure and commercial malware design
Analysis of the binary indicates that VOLTA is distributed as a malware-as-a-service product. The author supplies a builder template containing six modular slots where purchasers embed their specific settings, API tokens, and destination Telegram channels.
Although these configuration strings are encrypted inside the binary, researchers noted they can be extracted during forensic analysis. When the malware finishes running, it compresses the raw dossier and the generated analysis file into an archive and transmits it directly to the customer’s Telegram bot.
This design eliminates the need for attackers to run and maintain dedicated command-and-control servers. Because network traffic flows directly to OpenRouter and Telegram over standard secure web protocols, malicious communications blend into routine outbound web activity. Once exfiltration concludes, the main executable deletes itself from disk to hinder incident response efforts.
Defending against App-Bound Encryption bypasses
A significant portion of VOLTA’s credential collection relies on subverting App-Bound Encryption in Google Chrome, a security mechanism introduced to prevent external processes from extracting stored cookies and passwords. To circumvent this control, the infostealer spawns headless instances of Chrome, running the browser in the background without a graphical user interface.
System administrators can mitigate this specific extraction vector by enforcing application-control rules that stop unauthorised processes from launching headless Chrome instances. Restricting these execution flags blocks VOLTA from decrypting Chrome session tokens, though it does not prevent the malware from gathering system metadata, local files, or Outlook profiles.
Cisco Talos advises that compromised machines often retain a local debug log after the core binary deletes itself. This file documents which data categories were gathered and indicates whether the external model returned a target evaluation. Incident responders who identify signs of compromise should immediately revoke session tokens, change corporate passwords, and migrate cryptocurrency assets to newly generated addresses on air-gapped hardware.
The shift toward autonomous victim triage
The emergence of VOLTA highlights how malware developers are integrating natural language processing into post-exploitation routines. Criminal operations frequently capture far more data than human handlers can process, creating bottlenecks that delay extortion attempts or financial theft.
Using automated systems to inspect and rank compromised targets enables threat actors to focus manual effort exclusively on high-net-worth victims. Similar techniques have begun surfacing across Windows malware campaigns, including implants that query language models to determine their next execution steps or steal locally stored developer credentials to fund cloud computing calls.
As commercial artificial intelligence providers adjust model guardrails to identify and block unauthorised exploitation requests, malware authors are treating refusal evasion as a standard feature. Software updates and detection rules for VOLTA continue to evolve as enterprise security vendors track the builder across commercial cybercrime forums.
