Cisco Talos Finds Volta Infostealer Asking Claude Opus 4.6 to Rank Victims by Worth

TL;DR

Cisco Talos published a teardown on October 31 of Volta, a self-deleting Windows infostealer that calls itself "VOLTA-AUTODOXER" and ships with an optional AI stage. After it drains browsers, crypto wallets, and Discord, Telegram, Steam and Roblox sessions, it serializes the haul into a dossier and posts it to OpenRouter with a prompt that casts the model as "a forensic intelligence analyst drafting a target assessment." The default model is Claude Opus 4.6. If the reply contains "I can't" or "I'm not able," Volta retries with Kimi K2, then Gemini 2.5 Flash. Talos researcher Ryan Fetterman told WIRED that Talos has not tracked whether Volta has been used in the wild.

Cast a wide net, steal everything

Talos describes the idea behind Volta in its first sentence: "cast a wide net, steal everything, and let AI sort out the specifics." The stealing part is conventional and thorough. According to the report, Volta collects:

• Browser passwords, cookies and saved payment cards from Chromium browsers, plus Firefox and Thunderbird data.
• Cryptocurrency seed phrases, with an embedded cracker for wallet vaults.
• Discord, Telegram, Steam, Battle.net and Roblox sessions, and Microsoft OAuth tokens.
• SSH keys and cloud configs (gcloud, OpenVPN, Hide.me), Slack workspaces and Outlook profiles.
• Wi-Fi passwords dumped in plaintext through WlanGetProfileList, and screenshots.

Then comes a second sweep that uses the first sweep's loot. With the victim's own Gmail session, Volta searches for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal and reads them to establish a confirmed home address. Stolen Uber Eats and DoorDash sessions are called directly for order history. The Discord token gets reused to pull the account profile, and Roblox inventory is priced through a live lookup against Rolimons, a third-party Roblox item-value tracker. WIRED's reporters read the target list as "geared toward targeting younger internet users with robust digital lives."

All of it lands in Identity_Report.txt, the file that gets sent to the model.

The prompt

WIRED, which got the research first, counted a 240-word prompt with bullet points and a numbered list. It opens: "You are a forensic intelligence analyst drafting a target assessment from a structured evidence bundle." The model is told to produce an executive summary, a description of what the person does, a section on "what they're worth," and a summary of "their opsec." Talos spells out the two sections that matter to a buyer: WHAT THEY'RE WORTH ranks the victim's valuables by monetization in low, medium or high tiers, and THEIR OPSEC assesses security posture and password hygiene.

The prompt also tells the model to "connect dots across fields." WIRED's example from the text: check whether someone's Wi-Fi password matches their last name. Talos quotes the instruction "Go deep, not wide" and "Be blunt, specific, accurate." The request runs at temperature 0.2, which Talos reads as a bid for deterministic, consistent output.

"The prompt is pretty carefully crafted not to imply anything overtly malicious," Fetterman told WIRED.

The reply is saved as AI_Analysis.txt and zipped with the dossier into volta_dox.zip. Two other archives exist: volta_log.zip goes out right after the stealer runs, and volta_doxnet.zip is created only if the network enrichment finds anything.

Refused? Next model.

The API call is hand-assembled JSON with no SDK, sent with a "Mozilla/5.0" User-Agent to the OpenRouter chat completions endpoint. Volta checks each reply for the strings "I can't" or "I'm not able." If either appears, it moves down the chain: Claude Opus 4.6 first, then Kimi K2, then Gemini 2.5 Flash, up to three models in total.

It is the toddler strategy: ask Dad, and when Dad says no, ask Mom, and when Mom says no, ask Grandma.

"They're building in the expectation to potentially hit model refusals at first request. And so they plan for failover kind of cascading to more permissible models as they go down the chain," Fetterman said. "The AI calls are kind of above and beyond, but the malware will still work without it."

A refusal here protects one provider's output and nothing else. The request body is a system prompt plus a JSON evidence bundle, which is also what a legitimate fraud-review tool would send, so the cascade only breaks if every model in it says no. Talos closes on the same thought: "As AI integration in malware matures, refusal resilience may become a standard design requirement."

The models, and what they cost

OpenRouter's model list dates anthropic/claude-opus-4.6 to February 4, 2026, at $5 per million input tokens and $25 per million output tokens, with a 1M-token context. moonshotai/kimi-k2 is Moonshot's July 2025 release at $0.57 in and $2.30 out. google/gemini-2.5-flash, from June 2025, is $0.30 in and $2.50 out. Anthropic's model overview now files Opus 4.6 under legacy models that are still available; the current lineup is Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5.

WIRED's framing: "Building in fallbacks and relying on cost-effective, older-generation models are common techniques among attackers." The sample's compile timestamp is August 17, 2026, and Talos records it as first seen on October 11.

Sold as a kit

Volta is built from a template with six swappable slots filled in at build time. Talos reads that as a builder business: "The author sells access, the customer provides their values, and the builder compiles a custom binary for each order." One slot is a Telegram channel, so customers "start receiving ranked target assessments in their Telegram inbox." The slots also carry the credentials the customer supplies, including API keys. If no OpenRouter key is present, the AI stage is skipped and the stealer runs anyway.

The slot values are encrypted with a key derived from the SHA-256 of two constants in the same binary. Talos: "Anyone who reverses the file can recover them." The encryption is there, in Talos's reading, because customers "expect their API keys not to be sitting in plaintext, not because it provides real protection." So the operator's OpenRouter key is shielded from everyone except people who can open the file, a group that includes every malware analyst and every rival operator.

There is no attacker-owned infrastructure anywhere. Every endpoint Talos observed is a third party: OpenRouter, Telegram, Gmail, the food-delivery APIs, Rolimons. The binary is self-deleting.

"If you're able to identify your high-value targets faster, you probably have a better chance of using their credentials or authenticating using stolen tokens more often than maybe you would have if you had to do that triage yourself," Fetterman told WIRED. "We're seeing more advanced capabilities accessible to lower-level sophistication attackers."

Talos's own summary is blunter: "VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work."

What to do about it

• Much of Volta's token theft depends on bypassing Chrome's App-Bound Encryption by launching Chrome with --headless. Talos says an application-control policy restricting which processes may launch Chrome headless "would block the ABE decryption path entirely." At minimum, alert when Chrome starts headless from any process outside known developer tooling.
• Keep credentials in hardware-backed stores where you can.
• If you suspect an infection, preserve %APPDATA%\volta_debug.txt. It is a timestamped harvest log that records what was collected and whether the LLM call succeeded, and the main executable may already have deleted itself.
• Revoke tokens and change passwords. If a seed phrase sat on disk in plaintext, treat the wallet as fully compromised and move funds to a wallet whose seed was generated on an air-gapped device.

The Hacker News thread went straight to isolation: QubesOS, separate machines for banking and development, and one commenter's complaint that Claude Code in auto mode already runs find and ls across home folders, so a swapped endpoint URL would look like business as usual.

Caveats

• Talos did not track whether Volta has been used in the wild. This is an analysis of a sample, with no victim counts and no attribution.
• Talos's write-up does not say whether it observed a live LLM call succeed. The harvest log records success or failure per run, but the report describes no such run.
• The full system prompt appears in Talos's post only as an image. The 240-word count, the bullet points and the Wi-Fi password example come from WIRED's reading of it.
• "Volta-Autodoxer" is the name the malware uses for itself internally, which Talos and WIRED adopted.
• Prices are OpenRouter's list prices on November 1, 2026. What an operator's own key is billed at depends on their account.

Key Takeaways

• Cisco Talos published its analysis of Volta on October 31, 2026, after surfacing the sample through CAIRN, its effort to spot hacking tools that use AI.
• Volta posts a serialized dossier of stolen data to OpenRouter. The default model is anthropic/claude-opus-4.6; Kimi K2 and Gemini 2.5 Flash are fallbacks, selected by a substring check for "I can't" or "I'm not able."
• The prompt casts the model as a forensic intelligence analyst and demands a WHAT THEY'RE WORTH ranking in low, medium and high tiers plus a THEIR OPSEC assessment, at temperature 0.2.
• A second sweep uses the victim's own Gmail to confirm a home address from six merchants' receipts, pulls DoorDash and Uber Eats order history, and prices Roblox inventory via Rolimons.
• It is a six-slot builder kit with weak config encryption, no attacker infrastructure and Telegram delivery. Talos has not tracked in-the-wild use.
• Defenders: restrict or alert on headless Chrome launches, and preserve volta_debug.txt before cleanup.

Sources: Cisco Talos, "Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer", WIRED, Kernel Panic: "Spooky New Infostealer Malware Uses AI to 'Autodox' Victims", OpenRouter: Claude Opus 4.6, OpenRouter: Kimi K2, OpenRouter: Gemini 2.5 Flash, Anthropic models overview, Hacker News discussion