VOLTA infostealer asks Claude Opus 4.6 to rank victims by what they're worth, and falls back to Kimi K2 if it refuses

A new Windows infostealer doesn't stop at stealing passwords. After it has emptied a machine, it writes up a dossier on its owner and asks a large language model to rank what they are worth. Cisco Talos published its analysis of the malware, which calls itself VOLTA-AUTODOXER, on October 31, and the AI stage is wired to OpenRouter with Anthropic's Claude Opus 4.6 as the default model and a fallback chain for when the model says no.

The stealing part is thorough rather than novel. According to Talos, VOLTA takes browser passwords, cookies and saved cards from Chromium browsers, Firefox and Thunderbird data, Outlook profiles, Slack workspaces, Discord, Telegram, Steam, Battle.net and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider config files, every saved Wi-Fi password, and crypto wallets, which it tries to crack on the spot. Then it uses what it stole to learn more: it searches the victim's own Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls Uber Eats and DoorDash order history through the stolen sessions, and prices the victim's Roblox inventory with a live lookup.

The model as the operator's analyst

All of that lands in a file called Identity_Report.txt, which is serialized to JSON and sent to OpenRouter's chat completions endpoint. The system prompt tells the model to act as "a forensic intelligence analyst drafting a target assessment." The answer has to include a section titled "WHAT THEY'RE WORTH", ranking valuables by how easily they can be monetized, and one called "THEIR OPSEC", grading the victim's security habits and password hygiene. The prompt also asks the model to connect sparse data points: whether a password follows the victim's name, address or university, for example. "Go deep, not wide," it says. "Be blunt, specific, accurate."

Talos's point is that the model isn't helping with a classic malware capability like evasion or spreading. It replaces the slow human step of reading through a stolen log and deciding which victim deserves attention. Ryan Fetterman, the Talos researcher behind the analysis, told WIRED that faster triage matters because stolen tokens expire and passwords get changed.

Planning for refusals

The configuration is hardcoded and plain:

The refusal handling is a substring check. VOLTA looks for phrases like "I can't" or "I'm not able" in the reply and, if it finds one, moves down the chain to the next model. Talos reads the chain as a sign that the author expected guardrails to trigger. Fetterman told WIRED the prompt is "pretty carefully crafted not to imply anything overtly malicious", which is a fair description of a job framed as forensic analysis rather than target selection. And if there is no API key at all, the stealer works without the AI stage.

The model list is also telling. In late October 2026 none of these is a current frontier model: Opus 4.6, Kimi K2 and Gemini 2.5 Flash are all at least a generation old, and WIRED notes that cheaper, older models are a common choice for attackers. The sample's PE timestamp is August 17, 2026, and Talos first saw it on October 11.

Earlier this week we wrote about an anti-bot script that hides jailbreak prompts so that AI models refuse to deobfuscate it. VOLTA is the mirror image: one side tries to trigger refusals as a defense, the other treats them as an outage to route around.

What it gives away

Two details in the Talos write-up cut against the malware's sophistication. First, the inference call runs from the victim's machine, over the victim's connection, before anything is exfiltrated. Second, VOLTA appears to be sold through a builder: six template slots, including the Telegram channel and API keys, are filled in for each customer. Those values are "encrypted" with a key derived from SHA-256 of two constants stored in the same binary, so, in Talos's words, "anyone who reverses the file can recover them."

Our reading, not Talos's: that makes each build carry the customer's OpenRouter credentials in recoverable form, and an outbound request to openrouter.ai from a machine with no developer tooling is an unusual thing to see. Neither is a guaranteed tell, but the AI layer adds infrastructure the attacker doesn't control.

Talos's own countermeasures focus on the stealer. Much of the token theft depends on bypassing Chrome's App-Bound Encryption by launching Chrome with --headless, so restricting which processes can do that blocks the path. Victims should keep %APPDATA%\volta_debug.txt if it exists, since it logs what was collected and whether the LLM call succeeded.

What we don't know is how widely VOLTA is used. Fetterman told WIRED that Talos did not track whether it has been used in the wild. The analysis shows what the code is built to do, not how many people it has done it to.