On October 31, 2026, Cisco Talos, Cisco’s threat intelligence team, published its analysis of a Windows infostealer that calls itself “VOLTA-AUTODOXER.” It steals passwords, cookies, sessions and cryptocurrency wallets, and it can then send an AI model a dossier on the person using the computer. By default, the dossier goes to Anthropic’s Claude Opus 4.6 through the OpenRouter service; if the model refuses, Volta falls back to Moonshot AI’s Kimi K2, then to Google’s Gemini 2.5 Flash.
The report, written by researcher Ryan Fetterman, covers a single sample, first seen October 11, with no known attack campaign. WIRED, which Talos had shared the research with, reported on it the same day. Hackers were already using AI to carry out attacks: according to a NorForge report published October 19, a hacker let AI agents break into the websites of more than 100 companies. In Volta’s case, AI steps in after the theft: Talos describes the model as an intelligence analyst working on behalf of the operator.
From passwords to Uber Eats receipts
Talos calls Volta a “mature” stealer. It takes passwords, cookies and payment cards saved in Chromium-based browsers, and it also goes after Firefox, the Thunderbird email client, Outlook, Slack, Steam, Battle.net, Discord, Telegram, Roblox, Microsoft authentication tokens, and SSH and cloud configuration files. It dumps saved Wi-Fi passwords in plain text and runs a built-in cracker against encrypted cryptocurrency wallet vaults.
According to Talos, what sets Volta apart from commodity stealers is what comes next. Using the victim’s own Gmail tokens, it searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart or PayPal to confirm a home address. It pulls Uber Eats and DoorDash order history and values the victim’s Roblox inventory in real time.
“Your Uber Eats history is now a potential liability,” reads the caption of one figure in the report. WIRED says Volta’s toolkit seems geared toward younger internet users with busy digital lives.
An intelligence analyst’s brief
Volta then assembles a structured dossier in a file called Identity_Report.txt. Among other things, it holds geolocation and home address, the victim’s employer and the employer’s domain, an inferred birth year, Slack workspaces and the last four digits of payment cards. The dossier goes to OpenRouter with a system prompt that tells the model to act as “a forensic intelligence analyst drafting a target assessment.”
The required output includes a section titled “WHAT THEY’RE WORTH,” which ranks the victim’s assets by how much money they could bring in, in low, medium and high tiers. A “THEIR OPSEC” section is supposed to assess the victim’s security habits and passwords. Talos says the prompt demands citations back to the dossier and asks the model to connect scattered data points and draw inferences that add value to the haul.
WIRED reports that the 240-word prompt tells the model to “connect dots across fields”; the magazine’s example is checking whether the victim’s Wi-Fi password matches their last name. “The prompt is pretty carefully crafted not to imply anything overtly malicious,” Fetterman told the magazine.
The model call goes out over the victim’s own network connection, from their own machine. The model’s answer is designed to be exfiltrated with the dossier in an archive named volta_dox.zip, with the assessments destined for the operator on Telegram. Talos found no attacker-owned infrastructure: every endpoint it observed is controlled by a third party.
A fallback chain for refusals
The configuration Talos recovered points to the API of OpenRouter, a service that relays requests to models from several providers. The default model is anthropic/claude-opus-4.6, followed by moonshotai/kimi-k2 and then google/gemini-2.5-flash. Volta checks each response for refusal phrases such as “I can’t” or “I’m not able” and, if it finds one, moves on to the next model.
Talos writes that this multi-model setup “suggests that the operator is anticipating encountering refusals, with the fallback pivoting to a few, smaller, and more permissive models.” Claude Opus 4.6 is no longer part of Anthropic’s current Claude lineup, which is now at Opus 5.5, according to the company. WIRED notes that “building in fallbacks and relying on cost-effective, older-generation models are common techniques among attackers.”
The AI stage is optional: without an API key, Volta skips it and still steals the data.
A custom build for each buyer, Talos suspects
Volta keeps its Telegram channel, API keys and settings in a template with six swappable slots, filled in at build time. Talos sees this as a sign of a builder model, in which the author would sell access, each customer would supply their own values, and the builder would compile a custom binary for each order. The credentials in the template are encrypted, “but not in a meaningful way,” Talos writes, and anyone who reverses the file can recover them.
If Volta is indeed sold that way, Talos adds, the AI dossier becomes a product feature that lets a customer of any skill level receive ranked target assessments in their Telegram inbox. “We’re seeing more advanced capabilities accessible to lower-level sophistication attackers,” Fetterman told WIRED.
One sample, no known victims
The analysis covers a single file whose SHA-256 hash starts with 57ef4242 and whose compile timestamp reads August 17, 2026. Talos gives no victim count, campaign, distribution method, targeted countries or sectors, or sale price. Fetterman told WIRED that Talos did not track whether Volta has been used in the wild.
Nor does the report say whether Claude, Kimi K2 or Gemini 2.5 Flash accepted or refused these requests: Talos describes the fallback logic as written in the file and reports no tests. Neither Talos nor WIRED reports any comment from Anthropic, OpenRouter, Moonshot AI or Google. The builder model remains Talos’s inference, drawn from the structure of the file.
Talos’s countermeasures
Much of Volta’s token theft relies on bypassing Chrome’s App-Bound Encryption, so Talos suggests restricting which processes can launch Chrome with the --headless flag, or at least alerting on such launches. After an infection, it advises preserving the %APPDATA%\volta_debug.txt log (a record of what was collected and whether the model call succeeded), revoking tokens and changing passwords. Talos says a wallet whose seed phrase was stored in plain text should be treated as fully compromised.
The same logic as CLOSEDQUORUM
Volta surfaced through CAIRN, an open-source tool Talos released on September 22 to track AI-integrated malware. CAIRN has nothing to do with Cairn, the AI agent software in the NorForge case. The same day, Talos described CLOSEDQUORUM, a Windows implant that has up to four commercial models vote on its next move. Talos said at the time that it had no confirmation of in-the-wild deployment.
Talos ties the two cases to the same logic, which it calls “effort displacement”: “Identify the step that requires the most sustained human attention and replace it with a model call.” CLOSEDQUORUM gives AI the choice of its next action; Volta gives it victim triage. On October 12, Anthropic’s Frontier Red Team published a study on AI that may soon copy itself onto connected devices, another AI-driven malware scenario.
What it means
Volta hands the post-theft work to a commercial model with a detailed brief: judging what each victim is worth and which of their assets can be turned into cash. Its author planned for refusals. Fetterman says faster triage probably improves the odds of using tokens and passwords before they expire or get changed.
The dossier sent to the model lists the victim’s Slack workspaces, employer and employer’s domain, and the malware also steals Microsoft tokens, Outlook profiles and cloud access. On top of the access itself, an infected Windows machine can hand over a profile that places its user inside a company and grades their password habits.
Everything rests on a single sample: deployment, victims and the models’ responses remain undocumented. Talos writes that “refusal resilience may become a standard design requirement” as AI integration in malware matures. Model refusals on security topics also frustrate legitimate users: since October 21, Claude Opus 5.5 users have reported that the model blocks their reverse-engineering requests.
Several questions remain open: has OpenRouter blocked the keys Volta uses, how does the malware spread, and is it actually sold, as Talos suspects? Talos expects the pattern to appear elsewhere and leaves defenders with another question: which phase of an attack will it touch next?
Sources
- Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer, Cisco Talos (Ryan Fetterman), October 31, 2026
- Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims, WIRED (Lily Hay Newman and Matt Burgess), October 31, 2026
- The Closed Quorum: Inside the first reported autonomous AI C2 implant, Cisco Talos (Ryan Fetterman), September 22, 2026
- Introducing CAIRN: Frontier tracking for AI-integrated malware, Cisco Talos (Ryan Fetterman), September 22, 2026
- Models overview, Anthropic, accessed October 31, 2026
Header image: MACCUS chart. Data: Cisco Talos, October 31, 2026
