A Windows infostealer called VOLTA does something most stealers leave to a human: once it has emptied a PC, it asks an AI model to decide what the victim is worth. By default that model is Anthropic’s Claude Opus 4.6, and the answer comes back as a ranked list of valuables the criminal can cash in.
The malware deletes its own executable after running, and Cisco Talos says it found no server owned by the attacker behind it. The clean-up steps Talos recommends are at the end of this post.
Talos describes VOLTA in a research post. The first stage is ordinary theft: whatever the browsers and mail apps have saved, logged-in sessions for chat and gaming accounts, cloud and SSH credentials, screenshots, and the passwords of every Wi-Fi network the PC has joined. Crypto wallets get extra attention, because VOLTA tries to break open the vault right there instead of just copying it.
Building a dossier on one person
What sets it apart is the second stage. VOLTA writes up the person behind the PC: where they live, who they work for, roughly when they were born, which cards they own, who wrote their documents, and what their Roblox account would fetch. To firm up the address it reuses the victim’s own stolen Gmail session and hunts through the inbox for shopping and payment receipts from stores and services such as Amazon, DoorDash and PayPal, and it reads delivery histories too.
The file is sent to the OpenRouter model service with instructions to act as a “forensic intelligence analyst” writing a target assessment. The answer has to rate each of the victim’s assets as low, medium or high value and comment on how carelessly they protect their accounts. Talos says the prompt even asks the model to link names, addresses or schools to patterns in passwords. The request leaves from the victim’s own internet connection before the results are zipped and sent out.
A fallback for refusals
The authors expected the model to say no. VOLTA scans each answer for refusal phrases, then tries Moonshot’s Kimi K2 and Google’s Gemini 2.5 Flash in turn. With no OpenRouter key it skips the AI step and just sends the stolen data through Telegram. Six replaceable slots, for the Telegram channel, keys and settings, suggest it is sold as a build-to-order kit, and Talos notes that the encryption on those slots can be reversed by anyone who analyses the file.
Talos’s advice for anyone who may be infected: the program may be gone, but keep the log file volta_debug.txt in the AppData folder, since it records what was taken and whether the AI call worked. Revoke tokens, change passwords, and if a wallet seed phrase sat in plain text on the disk, move the funds into a freshly created wallet, with the new seed generated on a clean, offline device. Companies can block the Chrome step by restricting which programs may start Chrome in headless mode.
Talos calls the pattern effort displacement: find the step that takes the most human attention and hand it to a model. It expects malware makers to start designing around AI refusals as a matter of course.
