What is the VOLTA-Autodoxer infostealer?
Cisco Talos published its analysis of VOLTA-Autodoxer on 31 October 2026. The report's author is Ryan Fetterman, a Talos security researcher. The name comes from a label the malware uses for itself, according to WIRED.
An infostealer is malware that copies logins, cookies and session data from an infected computer. VOLTA does that, then adds a second stage. It sends the stolen material to large language models and asks them to assess the person behind the machine.
These tools are not a niche problem. WIRED notes that infostealers have stolen hundreds of millions of credentials in recent years. Several major breaches began with logins that such malware had already collected.
Talos calls the AI part an optional integration layer. The core stealer works without it. The model stage is what makes the sample unusual, because it turns a credential log into a ranked target list.
Talos found the sample through CAIRN, a toolkit it released on 22 September 2026. CAIRN looks for signs of AI use in file metadata, such as embedded prompts, provider endpoints and API key formats. It does not need to download or run the binary.
CAIRN searches with up to 24 acquisition filters. That design matters here, because the malware's most distinctive feature is a text prompt rather than a novel exploit. The hunting method starts from the prompt, not from the payload's behaviour.
The analysed file is a PE32+ x86-64 binary. It carried a PE timestamp of 17 August 2026, 20:35, and was first seen at 12:46 UTC on 11 October 2026. Talos lists two observed filenames: 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe.
The sample is self-deleting and uses no attacker-owned infrastructure. Every endpoint Talos observed was controlled by a third party. That makes the implant harder to trace and leaves defenders with fewer network clues to follow.
Talos sums up the shift in one line. Criminals can now "cast a wide net, steal everything, and let AI sort out the specifics." The sorting is the new part, and it is what the rest of the report examines.
How does VOLTA build a victim dossier?
The collection pass is broad. Talos lists the main targets in its report, and the list covers far more than saved passwords.
Crypto wallets get special handling. The stealer runs an embedded cracker against wallet vaults during the same pass. It writes the result to a line labelled WALLET VAULTS CRACKED in its own report.
Wi-Fi passwords are dumped through a direct call to WlanGetProfileList. Talos published a screenshot of plaintext network credentials as evidence. Those passwords can expose home routers and other devices on the same network.
A second pass uses the stolen access to build a profile. With the victim's Gmail token, VOLTA searches for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal. Those receipts help confirm a home address.
It then pulls order history from Uber Eats and DoorDash. It enriches the Discord profile through the stolen token and checks a Roblox inventory's value on Rolimons. Each step adds detail that a password list cannot provide.
The assembled bundle includes geolocation, employer and employer domain, an inferred birth year and card last-4 digits. It also carries document authorship metadata, Slack workspace names and iPhone backup indicators.
Everything is written locally to Identity_Report.txt. The output is not a list of passwords. It is a dossier about a person, built before any model is called.
- •Browser passwords, cookies and saved payment cards from Chromium-based browsers.
- •Firefox and Thunderbird data, Outlook profiles, Slack workspaces and Microsoft OAuth tokens.
- •Active Discord, Telegram, Steam, Battle.net and Roblox sessions.
- •SSH keys and cloud configuration files for gcloud, OpenVPN and Hide.me.
- •Every saved Wi-Fi password on the host, dumped in plaintext.
What does the AI stage actually ask the model to do?
VOLTA serialises the dossier as JSON and sends it to OpenRouter. OpenRouter is a routing service that can pass a request to several model providers. The system prompt casts the model as "a forensic intelligence analyst drafting a target assessment."
The requested output has two named sections. "WHAT THEY'RE WORTH" ranks the victim's valuables as low, medium or high. "THEIR OPSEC" assesses security posture and password hygiene.
The prompt also asks for citations back to the evidence bundle. It encourages the model to connect fields that look unrelated. WIRED describes one example: checking whether a Wi-Fi password matches the victim's last name.
WIRED reports that the prompt is about 240 words long, with bullet points and a numbered list. It includes the instruction "Go deep, not wide." It also asks the model to be "blunt, specific, accurate."
The request configuration is simple. Talos found hand-assembled JSON, no software development kit and a standard Mozilla/5.0 User-Agent. The temperature is hardcoded at 0.2, which favours repeatable answers over creative ones.
The model's reply is saved as AI_Analysis.txt. It leaves the machine with the dossier in an archive called volta_dox.zip. Talos says exfiltration can happen in up to three stages, before and after the AI call.
The inference runs on the victim's own computer, over the victim's own connection. The malware does not need to send the raw bundle to the operator first. It sends the finished analysis instead.
Talos calls the model the operator's triage analyst. The point is not retrieval. The model is asked to stretch sparse data into inferences that raise the value of what was stolen.
A ranking is only useful if it changes what happens next. A high-value label could push an operator toward account takeover, while a low-value label might leave a victim alone. Talos does not describe what buyers do with the scores.
Why does VOLTA switch models when one refuses?
The default model is anthropic/claude-opus-4.6. Talos found the model string hardcoded in the sample. If the first response looks like a refusal, the malware tries another provider.
The fallback chain is moonshotai/kimi-k2, then google/gemini-2.5-flash. Kimi K2 is a Chinese open-weight model. Gemini 2.5 Flash is an older, cost-effective model from Google.
WIRED notes that fallbacks and older, cost-effective models are common among attackers. The aim is to keep costs low and to avoid depending on one provider's policy.
The refusal check is blunt. VOLTA scans each reply for phrases such as "I can't" or "I'm not able." It can move through a chain of up to three models. If no API key is present, the AI stage is skipped.
Talos reads the chain as preparation, not improvisation. The operator expected guardrails to fire. Fetterman told WIRED the prompt is "pretty carefully crafted not to imply anything overtly malicious."
Fetterman also said the malware plans for refusals and can still run without AI. "The AI calls are kind of above and beyond," he told WIRED, "but the malware will still work without it."
The chain does not prove that any model produced an assessment. Talos describes the design and the expected refusals. It does not report which model answered, or whether an answer arrived at all.
That gap matters for providers. A refusal is not a security control if the next request goes to a different company. Routing services concentrate those requests, which makes the pattern easier to observe in principle.
Has VOLTA been used in real attacks?
No confirmed attack has been tied to VOLTA in the reporting reviewed here. Talos did not track whether the malware has been used in the wild, Fetterman told WIRED. The report describes capability, not casualties.
The public evidence is one sample. Talos lists one hash, two filenames and one first-seen timestamp. It does not estimate how many builds exist or how many operators hold them.
There is also no campaign infrastructure to map. Talos says all observed endpoints were third-party controlled. With no attacker-owned server, there is no obvious cluster of victims to count.
The AI stage is optional, so an infection does not equal an AI-ranked dossier. Without a key, VOLTA still steals credentials, sessions and wallets. The model call is an extra step that may fail or be left out.
Talos suspects the malware is sold as a service. The evidence is a build template with six swappable slots for credentials and settings. Buyers would supply their own values, and the builder would compile a custom binary for each order.
The slot encryption is weak. Talos says the key is the SHA-256 hash of two constants stored in the same binary. Anyone who reverses the file can recover the values. The encryption appears to meet customer expectations, not to provide real protection.
That sales model remains an inference. Talos found no marketplace listing in its analysis. The report describes what the code suggests, not a confirmed supply chain.
Related behaviour has been seen in the wild. On 29 October 2026, Talos published research on NIK C2, an AI-integrated command-and-control framework it observed in use. VOLTA's own deployment is still unconfirmed.
Talos has been building this research line since September. CAIRN launched with an initial finding called CLOSEDQUORUM, and the VOLTA report is a later entry in the same programme. The series is designed to track how AI features spread between malware families.
The model providers have not commented in the reporting reviewed. Neither Talos nor WIRED says whether Anthropic, Google, Moonshot AI or OpenRouter was contacted about the sample.
What does this mean for AI providers and guardrails?
The case turns a policy question into an engineering one. Model providers publish rules against abuse. Malware authors can now test those rules automatically and route around a refusal.
VOLTA's prompt is designed to look like analysis. It asks for a target assessment, not for hacking instructions. That framing may slip past filters that look for explicit requests to steal or break in.
The fallback chain also reveals attacker economics. Smaller and older models are cheaper. If a cheaper model will answer after a refusal, the operator saves money and keeps the pipeline running.
Talos expects this pattern to spread. Its conclusion says refusal resilience may become a standard design requirement for AI-integrated malware. That is a prediction, not an observation.
Defenders have one advantage. The AI stage leaves artifacts. CAIRN's filters look for provider endpoints, prompt templates, key prefixes and orchestration logic in metadata. Those traces can be hunted without running the binary.
CAIRN also scans for jailbreak terms and text aimed at AI analysis systems. That makes the prompt itself a detection surface. The report does not say whether any model provider scans inbound traffic for the same signals.
Talos released CAIRN as a research toolkit on 22 September 2026. VOLTA is one of its published findings, alongside the earlier CLOSEDQUORUM sample. The toolkit's value will depend on how many new samples it surfaces.
For providers, the open question is detection. Repeated model switching after a refusal would be an odd pattern for legitimate software. It is not proof of malice on its own, and the reporting reviewed here does not describe any provider monitoring for it.
For buyers of AI services, the lesson is narrower. Routing to multiple providers can reduce cost and downtime. It can also move a request past a guardrail that was working as intended.
What should defenders do next?
Talos's defensive advice starts before the model call. Much of VOLTA's token theft depends on bypassing App-Bound Encryption in Chrome. An application control policy can limit which processes launch Chrome in headless mode.
At minimum, defenders can alert when Chrome starts headless from an unexpected process. Hardware-backed credential storage also helps. Neither measure stops every stealer, but both raise the cost of bulk token theft.
Incident response has a few concrete steps. Talos recommends preserving the local debug log, then revoking anything that may have leaked.
For individuals, the infection route is familiar. WIRED notes that infostealers are often hidden in counterfeit software. Avoiding pirated installers and unverified downloads remains the simplest defence.
The wider warning is about triage. Infostealers collect far more data than one operator can easily review. A model that ranks the haul changes the economics of acting on it. Speed matters because tokens expire and passwords get reset.
The next signals to watch are specific. More CAIRN findings would show whether other stealers copy the model chain. Telemetry from security vendors could confirm or rule out real infections. Provider statements could clarify whether any named model answered.
Until then, the verified claim is narrow. A mature Windows stealer has been built with an AI triage layer. Its authors planned for models that refuse, and they built a way around them.
- •Preserve APPDATA%\volta_debug.txt, which logs what was collected and whether the AI call succeeded.
- •Revoke exposed tokens and change passwords for affected accounts.
- •Treat any wallet with a plaintext seed phrase as compromised.
- •Move funds to a new wallet generated on an air-gapped device.