目次8セクション
- What is the Volta infostealer and why is it called AI malware?
- From stolen data to an AI dossier: the four-stage flow
- What infostealers take and how each item hurts you
- Crypto wallet security and account hardening checklist
- What to do if you suspect an infection
- Separating hype from what the report shows
- よくある質問
- 出典・参考資料
VOLTA is AI malware in a narrow but important sense: it is an infostealer that, after grabbing passwords, cookies and crypto wallets from a Windows PC, sends the haul to a large language model and asks it to rank the victim by how much they are worth. Cisco Talos described the sample in a report published on October 31, 2026. The model does not break into anything. It plays the role of the operator's analyst, turning a raw credential log into a prioritized dossier. This guide, current as of November 1, 2026, explains what the report confirms, what it leaves open, and the practical steps crypto holders and everyday users can take.
What is the Volta infostealer and why is it called AI malware?
The sample calls itself VOLTA-AUTODOXER. It is a self-deleting Windows stealer that Talos found through CAIRN, its research effort for tracking AI-integrated malware. The sample details list a first-seen date of October 11, 2026 (UTC). The theft itself looks like a mature commodity stealer. What is new is the post-theft stage, where the stolen records are packaged and handed to an LLM.
The system prompt Talos published tells the model to act as a forensic intelligence analyst drafting a target assessment. The required output includes a section titled WHAT THEY'RE WORTH, which ranks the victim's valuables by monetization potential in low, medium and high tiers, and a section called THEIR OPSEC that judges the victim's security habits and password hygiene. The prompt also pushes the model to connect sparse clues, such as linking a victim's name, address or university to patterns in their passwords. In other words, the model is asked to stretch the stolen data and infer more value from it.
Built to survive model refusals
VOLTA sends its request through OpenRouter, a multi-model API gateway. According to Talos, the default model string is anthropic/claude-opus-4.6. If the reply contains refusal phrases such as I can't, the malware falls back to moonshotai/kimi-k2 and then google/gemini-2.5-flash, trying up to 3 models in total. Temperature is fixed at 0.2 for consistent output. Talos reads the fallback chain as evidence that the author expected to hit guardrails and engineered around them. Those model names are attacker configuration, not a sign that any model vendor took part. The stealer also runs without the AI stage when no key is present.
From stolen data to an AI dossier: the four-stage flow
Breaking VOLTA into stages makes it easier to see where a defender, or an ordinary user, can limit the damage.
- 1
1. Collect
Saved passwords, cookies and payment cards from Chromium-based browsers; Firefox, Thunderbird and Outlook profiles; Slack, Discord, Telegram, Steam and Roblox sessions; Microsoft OAuth tokens; SSH and cloud configuration files; every saved Wi-Fi password; and screenshots. Crypto wallet vaults are not just copied: an embedded cracker tries to open them.
- 2
2. Enrich
Using the victim's own authenticated sessions, VOLTA searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls food-delivery order history, enriches the Discord profile and values Roblox inventory through a live lookup.
- 3
3. Appraise
The data is assembled locally in Identity_Report.txt, serialized as JSON and posted to the LLM with the system prompt. The call runs from the victim's machine over the victim's own connection, and the answer is saved as AI_Analysis.txt.
- 4
4. Exfiltrate
Archives leave in up to 3 stages: after the theft, after the AI call, and after network enrichment if it produced anything. Talos observed only third-party endpoints and no attacker-owned infrastructure.
The build process matters too. Instead of hardcoding settings, VOLTA uses a template with 6 swappable slots for values such as a Telegram channel and API keys. Talos believes this points to a builder sold to customers, so even a low-skill buyer could receive ranked target assessments in a Telegram inbox. The report does not say how the malware first reaches a PC, so treat claims about a specific delivery method, such as a particular phishing lure or fake installer, as unverified unless they cite new evidence.
What infostealers take and how each item hurts you
Not all stolen data is equal. A session cookie is the most underrated item because it represents a login that already passed your password and second factor. The table maps the categories in the Talos report to practical countermeasures.
Browser-saved passwords
- What the attacker gains
- Logins on every site where you reused them
- What you can do
- Use a dedicated password manager and unique passwords
Session cookies and OAuth tokens
- What the attacker gains
- Account access without re-entering MFA
- What you can do
- Sign out all devices and revoke app access after a suspected infection
Wallet vaults and seed phrases
- What the attacker gains
- Ability to move your crypto
- What you can do
- Keep seeds off the PC; hold long-term funds on a hardware wallet
Email receipts and delivery history
- What the attacker gains
- Home address and daily patterns
- What you can do
- Lock down your primary email first and prune old sessions
SSH keys and cloud configs
- What the attacker gains
- Access to servers and cloud accounts
- What you can do
- Rotate keys and review cloud access logs
Saved Wi-Fi passwords
- What the attacker gains
- Network credentials in plaintext
- What you can do
- Consider changing the router password
Browsers have tried to raise the cost of cookie theft. Starting with Chrome 127 in 2024, Google added App-Bound Encryption on Windows. Google's security blog explains that the older Windows DPAPI protection does not stop a malicious app running as the logged-in user, while the new scheme ties decryption to the app's identity. Talos, however, reports that much of VOLTA's token theft relies on bypassing that protection by launching Chrome with the --headless flag. Browser hardening makes theft noisier and harder; it is not a complete defense on an already infected machine.
Crypto wallet security and account hardening checklist
An infostealer can empty many accounts within minutes of running, so the goal is to make sure a single infection cannot reach everything. These steps are ordered by impact for a typical crypto holder.
- Split wallets by purpose
- Keep long-term holdings on a hardware wallet whose signing keys never touch the PC, and leave only spending money in browser extension wallets.
- Never store a seed phrase in a text file, screenshot, cloud drive or email draft. VOLTA actively tries to crack wallet vaults.
- Upgrade your second factor
- CISA's MFA guidance names FIDO/WebAuthn as the only widely available phishing-resistant method and notes that any MFA beats none. Start with your exchange and primary email accounts.
- Add exchange withdrawal friction
- Enable withdrawal address allowlists, extra confirmation for withdrawals and new-device login alerts, so a hijacked session cannot move funds instantly.
- Prune sessions on a schedule
- Review active sessions in Google, Microsoft, Telegram and Discord, end anything you do not recognize, and remove unused connected apps.
- Treat unknown executables as hostile
- Cracked software, game cheats and files sent over chat are common stealer carriers. Google notes that limiting administrator rights forces malware toward more detectable techniques.
News about wallet drainers and phishing campaigns often spreads first in Telegram channels. theddari's Telegram trend pages show which security topics crypto and AI channels are discussing, which can help you notice an active campaign sooner. Confirm any action against official exchange or wallet notices and the original security research; a trend page shows what people are talking about, not whether a file or link is safe.
What to do if you suspect an infection
Because VOLTA deletes its own executable, a clean antivirus scan afterwards proves little. Talos recommends preserving the %APPDATA%\volta_debug.txt file, a timestamped harvest log that records exactly what was collected and whether the LLM call succeeded.
- 1
Isolate the machine
Disconnect it from the network and stop signing in on it. Keep logs and suspicious files rather than deleting them.
- 2
Recover accounts from a clean device
Change passwords for email, exchanges and messengers, then sign out all sessions and revoke tokens. Talos explicitly advises revoking potentially compromised tokens.
- 3
Move crypto to a brand-new wallet
If the seed phrase was on disk in plaintext, Talos says to treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device. Re-importing the old seed elsewhere does not help.
- 4
Report and document
Notify your exchange and bank, then file with your national cybercrime authority. In South Korea, KISA's hotline is 118.
Separating hype from what the report shows
Headlines about AI malware can suggest a machine that hacks on its own. The Talos report shows something more mundane and arguably more scalable: the model takes over the most attention-heavy human step, reading huge piles of stolen logs and deciding whom to pursue first. Talos sees the same logic in other AI-integrated implants and calls it effort displacement. A wide net that sorts itself means victims who look wealthy can be targeted faster and with more context.
The report also leaves things out. It does not give infection counts, losses or the initial delivery vector, so be skeptical of articles that supply those numbers without new sources. For individuals, the defenses are the same fundamentals that worked before the AI layer: keep seed phrases off your computer, separate long-term holdings from spending funds, use phishing-resistant MFA, and make session cleanup part of every incident response.
