New VOLTA infostealer uses LLMs to rank victims by how much their data is worth
Cisco Talos says the Windows infostealer VOLTA sends each victim's stolen data to large language models, which rank the haul by resale value and profile the person behind the machine.
At a glance
- The Hacker News reported the findings on November 2, 2026, citing research by Cisco Talos.
- VOLTA steals browser passwords and cookies, payment cards, crypto wallet seed phrases, SSH keys and session tokens from Windows machines.
- The stolen data is sent through OpenRouter to Claude Opus 4.6, falling back to Kimi K2 and Gemini 2.5 Flash, to rank victims by monetization value.
- Talos assesses the AI layer mainly displaces the operator's analytical effort and may be sold as a builder kit to low-skilled buyers.
A newly documented Windows infostealer called VOLTA uses commercial large language models to grade each victim's stolen data by how much money it could fetch, according to research by Cisco Talos that The Hacker News reported on November 2, 2026. Unlike typical credential thieves that simply dump what they grab, VOLTA adds an analysis layer that turns raw loot into what Talos researcher Ryan Fetterman described as a structured intelligence bundle about the person behind the machine.
What happened
The Hacker News, citing Talos, says VOLTA (also tracked as VOLTA-AUTODOXER) harvests the usual range of data from an infected Windows system: passwords and cookies from Chromium-based browsers, Outlook profiles, Slack workspaces, payment cards, cryptocurrency wallet seed phrases, and sessions for Discord, Telegram, Steam and Roblox. According to the report, it also collects Microsoft OAuth tokens, SSH keys, cloud-provider keys, Wi-Fi profiles and screenshots.
How the AI layer works
Per Talos, the collected data is serialized and sent through the OpenRouter service with a roughly 240-word system prompt that casts the model as a forensic intelligence analyst drafting a target assessment. Requests default to Anthropic's Claude Opus 4.6; if a model refuses, VOLTA detects phrases such as "I can't" and falls back to Moonshot AI's Kimi K2 and then Google's Gemini 2.5 Flash, chaining up to three models. The report says the required output includes a section ranking the victim's valuables into low, medium and high tiers and another assessing the victim's security habits and password hygiene.
The Hacker News adds that VOLTA uses stolen session access to search the victim's Gmail for receipts from services such as Amazon, DoorDash, Uber Eats and PayPal to corroborate a home address. Talos says the resulting profile can include geolocation, employer and domain, inferred birth year, card last-four digits and a live Roblox account valuation.
Who is affected
The report does not name specific targets, sectors or regions, and lists no indicators of compromise. According to Talos, data is exfiltrated to the operator over Telegram at three stages: immediately after the stealer runs, after the AI analysis, and after the Gmail enrichment. Talos suggests the author either sells a builder kit or compiles a custom binary per order, noting a six-slot template filled in at build time for settings such as the Telegram channel and API keys.
What to do
Talos frames the significance as effort displacement rather than greater speed or scale: the AI does the triage work an operator would otherwise do by hand, which Talos warns could let buyers of any skill level receive ranked victim assessments. The report offers no specific indicators; defenders should rely on standard infostealer hygiene, including endpoint protection, blocking unknown outbound traffic to services such as OpenRouter and Telegram, and rotating credentials, browser sessions and wallet keys on any machine suspected of compromise.
Sources
This story is based on the sources listed above. Always check the vendor’s official advisory before acting on critical systems.
