VOLTA Stealer Has Claude Appraise Its Victims Before Cashing In

A new Windows infostealer called VOLTA doesn’t just grab your passwords. It sends what it took to an AI model and asks for a written verdict on how much you’re worth. In a write-up by Ryan Fetterman, Cisco Talos says VOLTA (full name VOLTA-AUTODOXER) bundles stolen credentials, cards, wallets and personal details into an “evidence bundle,” has Anthropic’s Claude Opus 4.6 turn it into a dossier, then uses the victim’s own Gmail and food-delivery sessions to confirm a home address. The Hacker News also covered the research.

SHA256: 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
File names: 9BY0tjwOc3ut.exe, yLP9m5J3i2Aw.exe
%APPDATA%\volta_debug.txt
volta_log.zip, volta_dox.zip, volta_doxnet.zip
Identity_Report.txt, AI_Analysis.txt

Source article: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
Publisher: Cisco Talos (Ryan Fetterman)
Published: October 31, 2026
URL: https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/

Executive Summary

Cisco Talos documents VOLTA-AUTODOXER (also reported as VOLTA), a 64-bit Windows infostealer (PE timestamp Aug. 17, 2026, first seen Oct. 11, 2026) that Talos assesses is sold to customers through a builder model, with the buyer’s Telegram channel, API keys and settings filled into six template slots at build time and encrypted with a key derived from two constants in the binary; no threat actor, victims, sectors or delivery method are named. On execution it harvests passwords, cookies and saved cards from Chromium browsers (relying on a Chrome App-Bound Encryption bypass that launches Chrome with –headless), Firefox and Thunderbird, Outlook profiles, Slack workspaces, Discord, Telegram, Steam, Battle.net and Roblox sessions, Microsoft OAuth tokens, SSH keys, gcloud, OpenVPN and Hide.me configs, cryptocurrency wallets (cracking vaults inline), Wi-Fi passwords through WlanGetProfileList, and screenshots, logging progress to %APPDATA%\volta_debug.txt and exfiltrating volta_log.zip. It then assembles an Identity_Report.txt evidence bundle (geolocation and home address, employer and domain, inferred birth year, card last four digits, document authorship, iPhone backup indicators, Roblox valuation), sends it through OpenRouter’s chat completions API to anthropic/claude-opus-4.6 with refusal-triggered fallback to moonshotai/kimi-k2 and google/gemini-2.5-flash, and ships the resulting AI_Analysis.txt dossier in volta_dox.zip. Finally it reuses stolen sessions to search Gmail for delivery and shopping receipts, pull Uber Eats and DoorDash order history and value Roblox inventory on Rolimons, exfiltrates volta_doxnet.zip and deletes itself. The objective is victim triage for fraud and account takeover; impact on an infected host is total credential, session and wallet compromise plus exposure of the victim’s physical address. Talos found no attacker-owned infrastructure and published no detection rules; hunt leads, false positive expectations and indicators are detailed below.

ATT&CK chain: Credential Access → Discovery → Collection → Exfiltration → Defense Evasion

Hunt Lead Grid

VOLTA Sample and Staging-File Sweep

Talos analyzed one VOLTA build, SHA-256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, seen under the random-looking names 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe. While it runs, the stealer writes a timestamped harvest log to %APPDATA%\volta_debug.txt recording what it collected and whether the LLM call worked, builds Identity_Report.txt as the model’s input and receives AI_Analysis.txt back, and packages loot in three stages: volta_log.zip immediately after harvesting, volta_dox.zip after the AI call, and volta_doxnet.zip if the Gmail and delivery-app enrichment returns anything. The binary then deletes itself. The detection logic is a retrospective hash match in EDR and file-inventory data, plus a file-creation search for volta_debug.txt under any user’s AppData\Roaming and for files named volta_log.zip, volta_dox.zip or volta_doxnet.zip anywhere, with Identity_Report.txt and AI_Analysis.txt as supporting hits.

Sweep at least 90 days of EDR file events, since Talos first saw the sample on Oct. 11 and builder customers compile their own copies; expect the hash to miss other builds and treat the file names as the durable signal. Because the executable removes itself, the debug log and archive names are often the only artifacts left, so search for them even when no suspicious process is found, and preserve volta_debug.txt on any hit: Talos notes it lists exactly what was taken, which drives which passwords, sessions and wallets need rotating. Twelve-character random executable names in Downloads or Temp are worth pairing with this lead. Any hit is a confirmed compromise: isolate the host, then revoke sessions and rotate credentials from a clean device.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Collection → T1560 (Archive Collected Data), T1005 (Data from Local System) (our mapping; the source gives no ATT&CK IDs)

Sources: “Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer”, Cisco Talos, Oct. 31, 2026, https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ (source article)

Headless Chrome Launched by a Non-Browser Process

Talos says much of VOLTA’s token theft relies on bypassing Chrome’s App-Bound Encryption, the protection that ties cookie and password decryption to Chrome itself, and that the decryption path goes through Chrome launched with –headless; its own countermeasure is an application-control policy restricting which processes may start Chrome that way. Talos doesn’t publish the full command line, so build the rule on the behavior it does describe: chrome.exe (or msedge.exe and other Chromium browsers) starting with –headless whose parent is not the browser itself, a signed developer or automation tool, or a known management agent, especially when the parent is an unsigned executable in Downloads, Temp or AppData. Raise confidence when the same parent also reads the browser’s Login Data, Cookies or Web Data files, or calls WlanGetProfileList, within the same minute.

Use EDR process creation with full command line and parent signature, or Sysmon Event ID 1, plus file-access telemetry for the browser profile folders where available. Scope by host role: developer and build machines run Puppeteer, Playwright and Selenium all day, so allowlist those by the signed path of node.exe, python.exe or the test runner and by known script locations, never by process name alone; on ordinary office endpoints, headless Chrome from an unsigned parent is rare enough to alert directly. Blocking chrome.exe or its hash is the wrong control because the browser is legitimate; restricting who may launch it headless, as Talos suggests, is the right one. Sweep 30 to 90 days. This lead generalizes well beyond VOLTA, since many current stealers use the same headless trick against App-Bound Encryption. Treat a hit on a non-developer machine as an active stealer infection.

Hunt Lead Level: 2 (Pro)

ATT&CK: Credential Access → T1555.003 (Credentials from Password Stores: Credentials from Web Browsers), T1539 (Steal Web Session Cookie) (our mapping; the source gives no ATT&CK IDs)

Sources: “Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer”, Cisco Talos, Oct. 31, 2026, https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ (source article)

Credential Theft, Then OpenRouter and Telegram Uploads

VOLTA’s network behavior has a fixed order. After harvesting, it sends volta_log.zip to the buyer’s Telegram channel; it then posts hand-assembled JSON (no SDK, user agent simply Mozilla/5.0, temperature 0.2) to hxxps://openrouter[.]ai/api/v1/chat/completions asking for anthropic/claude-opus-4.6, retries with moonshotai/kimi-k2 and google/gemini-2.5-flash if the answer contains refusal phrases such as “I can’t” or “I’m not able,” and sends volta_dox.zip with the AI dossier to Telegram; a third upload follows after enrichment. Talos says every endpoint is third-party, so there is no attacker domain to block. The detection logic correlates, per process, access to browser credential stores or the Chrome headless launch from the previous lead, followed within minutes by DNS or TLS connections to openrouter[.]ai and to Telegram’s API from the same unsigned image, with a bare Mozilla/5.0 user agent on the OpenRouter request where TLS inspection exposes it.

Join EDR network events with process attribution to proxy or DNS logs. The services themselves are legitimate: developers and AI desktop apps call LLM gateways, and Telegram desktop talks to Telegram’s servers, so allowlist those by signed image path and alert only when a process outside the allowlist reaches either service, and escalate when it reaches both. Blocking openrouter[.]ai can be reasonable where nobody uses it, but blocking Telegram organization-wide often isn’t, which is why the sequence matters more than any single domain. A single repeated OpenRouter call with three different model names in a few seconds is itself a strong tell of the refusal-fallback chain. On the account side, OpenRouter keys embedded in builds belong to the buyer, so abuse reports to the provider with timestamps can help disrupt the operation. Any confirmed sequence means the victim’s data has already left; respond as a full credential compromise.

Hunt Lead Level: 3 (Elite)

ATT&CK: Exfiltration → T1567 (Exfiltration Over Web Service) (our mapping for the Telegram uploads; the LLM call itself has no ATT&CK technique)

Sources: “Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer”, Cisco Talos, Oct. 31, 2026, https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ (source article); “New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value”, The Hacker News, Nov. 2, 2026, https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html (additional source, same malware; three-stage Telegram exfiltration)

Receipt Searches From a Stolen Mail Session

Once the AI dossier is built, VOLTA uses the victim’s stolen Google session to search Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to corroborate a home address, calls stolen Uber Eats and DoorDash sessions directly for order history, reuses the Discord token to enrich the profile, and values Roblox inventory through a live lookup on Rolimons. This happens from the infected machine shortly after the stealer runs, so the requests come from the victim’s own IP but with a session the user didn’t open in their browser at that moment. The detection logic, for organizations that manage Google Workspace, is a burst of mailbox searches for several of those merchant names within a few minutes from one session, especially a session whose user agent or client differs from the user’s normal browser; for consumer accounts, the equivalent is Google’s security activity showing unfamiliar access.

Use Google Workspace audit logs (Gmail search and access events where your edition records them) and identity-provider sign-in logs, correlated with endpoint alerts from the first three leads. Users legitimately search for receipts, so require multiple merchant searches in a short burst, or the same burst within an hour of a headless Chrome or volta_debug.txt hit. Session cookies bypass passwords and MFA, so the response is to revoke all sessions and OAuth grants for the account, not just reset the password; device-bound session credentials, where supported, blunt this whole class of attack. Food-delivery and shopping accounts sit outside corporate visibility, so tell affected users to sign out of all devices on those services too. This lead generalizes to any stealer operator who replays sessions, which is common.

Hunt Lead Level: 3 (Elite)

ATT&CK: Collection → T1114.002 (Email Collection: Remote Email Collection); Defense Evasion → T1550.004 (Use Alternate Authentication Material: Web Session Cookie) (our mapping; the source gives no ATT&CK IDs)

Sources: “Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer”, Cisco Talos, Oct. 31, 2026, https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ (source article)

Hash Appendix

VOLTA-AUTODOXER sample

The SHA-256 and file names come from the source article; MD5 and SHA-1 were sourced via OTX AlienVault.

MD5s
4632e6d7c4ea43050d5b57b2106c9f3d  # 9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe -> VOLTA stealer, PE32+ x86-64 (sourced via OTX)

SHA1s
072863bda727c6859004d8324c20cbfb9ff816cf  # 9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe -> VOLTA stealer, PE32+ x86-64 (sourced via OTX)

SHA256s
57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279  # 9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe -> VOLTA stealer, PE32+ x86-64

References Appendix

• “Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer”, Cisco Talos (Ryan Fetterman), Oct. 31, 2026, https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ (source article; capabilities, AI workflow, file artifacts, sample hash, countermeasures)
• “New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value”, The Hacker News (Ravie Lakshmanan), Nov. 2, 2026, https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html (Telegram exfiltration stages)
• OTX AlienVault file indicator record for 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, AlienVault, accessed Nov. 2, 2026, https://otx.alienvault.com/ (MD5 and SHA-1)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/