Volta malware uses LLMs to rank stolen data by victim value

A new Windows infostealer named VOLTA-AUTODOXER has emerged with a distinct capability: it uses large language models to analyze stolen data and rank victims by their potential monetary value. First observed in October 2026, this malware automates the triage process that typically requires human analysts, turning raw credential dumps into structured intelligence reports.

What happened

VOLTA operates as a mature stealer implant that harvests a wide array of sensitive information from infected machines. Its collection targets include browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, and session tokens for platforms like Discord, Telegram, Steam, and Roblox. It also extracts Microsoft OAuth tokens, SSH keys, cloud provider configurations, Wi-Fi profiles, and screenshots. Unlike many commodity stealers, VOLTA goes beyond simple extraction by performing live enrichment using the stolen sessions themselves.

After gathering initial data, the malware uses authenticated access to victim accounts to deepen its intelligence profile. It queries Gmail inboxes for purchase receipts from services like Amazon, DoorDash, and Uber Eats to confirm home addresses. It pulls order histories from food delivery apps and uses Discord tokens to enrich user profiles. For cryptocurrency enthusiasts, it performs live lookups on Rolimons.com to value Roblox inventories. This enriched data is compiled into a structured evidence bundle that includes geolocation, employer details, inferred birth year, and security posture assessments.

The core innovation lies in how this bundle is processed. VOLTA serializes the data into JSON and sends it to an external LLM provider via OpenRouter. The system prompt instructs the model to act as a forensic intelligence analyst, producing a report with sections titled "WHAT THEY'RE WORTH" and "THEIR OPSEC." The output ranks assets by monetization potential and evaluates the victim's password hygiene. This allows low-sophistication actors to receive high-quality target prioritization without manual effort.

How it works

The AI integration is designed for resilience against model guardrails. VOLTA defaults to using anthropic/claude-opus-4.6 but monitors responses for refusal phrases like "I can’t" or "I’m not able." If a refusal is detected, it fails over to a chain of alternative models, specifically moonshotai/kimi-k2 and then google/gemini-2.5-flash. This multi-model architecture suggests the developers anticipate and engineer around safety refusals, ensuring the analysis completes even if the primary model blocks the request.

The malware communicates with the LLM endpoint at https[:]//openrouter[.]ai/api/v1/chat/completions using hand-assembled JSON requests and a Mozilla/5.0 User-Agent string, avoiding standard SDKs. The temperature parameter is hardcoded to 0.2, favoring deterministic and consistent outputs over creativity. The entire inference round-trip occurs on the victim’s machine and network connection before the final dossier, saved as "AI_Analysis.txt," is exfiltrated alongside the raw identity report in a zip file.

Key details

• VOLTA uses a builder model where customers provide API keys and settings via a template with six swappable slots, which are weakly encrypted in the final binary.
• The malware bypasses Chrome’s App-Bound Encryption by launching the browser in headless mode to decrypt stored credentials.
• It performs inline cracking of cryptocurrency wallets and dumps all saved Wi-Fi passwords to plaintext using the WlanGetProfileList function.
• The AI analysis prompt explicitly asks the model to make connections between sparse data points, such as linking names or universities to password patterns.
• There is no attacker-owned infrastructure; all communication relies on third-party services like OpenRouter and Telegram for command and control.
• The malware is self-deleting after execution, but leaves behind a debug log file at "APPDATA%\volta_debug.txt" if not fully cleaned.

Why it matters

This development marks a shift in cybercrime operations from volume-based theft to value-based targeting. By automating the analytical work of sifting through thousands of stolen records, VOLTA lowers the operational floor for criminals. Actors no longer need skilled analysts to identify high-value targets; they can simply deploy the stealer and receive ranked dossiers. This efficiency increases the return on investment for each infection, potentially encouraging more widespread deployment.

For defenders, the use of LLMs introduces new challenges in detection and response. The reliance on third-party AI providers means there is no central command server to block, and the traffic may resemble legitimate API calls. Furthermore, the ability to bypass modern browser security features like App-Bound Encryption highlights the need for stricter application control policies. Security teams must assume that any stolen session token can be used to enrich an attack profile in real-time, making immediate token revocation critical.

What you can do

• Implement application control policies that restrict which processes can launch Chrome with the --headless flag to prevent ABE bypasses.
• Monitor for unusual outbound connections to AI API endpoints like OpenRouter from end-user devices.
• Enforce hardware-backed storage for credentials and avoid saving passwords in browsers where possible.
• If compromised, preserve the "APPDATA%\volta_debug.txt" file for forensic analysis before deleting it.
• Immediately revoke all OAuth tokens and change passwords for any accounts that may have been exposed.
• Treat any cryptocurrency wallet with a seed phrase stored on disk as fully compromised and migrate funds to a new air-gapped wallet.