VOLTA is AI malware in a narrow but important sense: it is an infostealer that, after grabbing passwords, cookies and crypto wallets from a Windows PC, sends the haul to a large language model and asks it to rank the victim by how much they are worth. Cisco Talos described the sample in a report published on October 31, 2026. The model does not break into anything. It plays the role of the operator's analyst, turning a raw credential log into a prioritized dossier. This guide, current as of November 1, 2026, explains what the report confirms, what it leaves open, and the practical steps crypto holders and everyday users can take.

What is the Volta infostealer and why is it called AI malware?

The sample calls itself VOLTA-AUTODOXER. It is a self-deleting Windows stealer that Talos found through CAIRN, its research effort for tracking AI-integrated malware. The sample details list a first-seen date of October 11, 2026 (UTC). The theft itself looks like a mature commodity stealer. What is new is the post-theft stage, where the stolen records are packaged and handed to an LLM.

The system prompt Talos published tells the model to act as a forensic intelligence analyst drafting a target assessment. The required output includes a section titled WHAT THEY'RE WORTH, which ranks the victim's valuables by monetization potential in low, medium and high tiers, and a section called THEIR OPSEC that judges the victim's security habits and password hygiene. The prompt also pushes the model to connect sparse clues, such as linking a victim's name, address or university to patterns in their passwords. In other words, the model is asked to stretch the stolen data and infer more value from it.

Built to survive model refusals

VOLTA sends its request through OpenRouter, a multi-model API gateway. According to Talos, the default model string is anthropic/claude-opus-4.6. If the reply contains refusal phrases such as I can't, the malware falls back to moonshotai/kimi-k2 and then google/gemini-2.5-flash, trying up to 3 models in total. Temperature is fixed at 0.2 for consistent output. Talos reads the fallback chain as evidence that the author expected to hit guardrails and engineered around them. Those model names are attacker configuration, not a sign that any model vendor took part. The stealer also runs without the AI stage when no key is present.

From stolen data to an AI dossier: the four-stage flow

Breaking VOLTA into stages makes it easier to see where a defender, or an ordinary user, can limit the damage.

1. 1

   1. Collect

   Saved passwords, cookies and payment cards from Chromium-based browsers; Firefox, Thunderbird and Outlook profiles; Slack, Discord, Telegram, Steam and Roblox sessions; Microsoft OAuth tokens; SSH and cloud configuration files; every saved Wi-Fi password; and screenshots. Crypto wallet vaults are not just copied: an embedded cracker tries to open them.

2. 2

   2. Enrich

   Using the victim's own authenticated sessions, VOLTA searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls food-delivery order history, enriches the Discord profile and values Roblox inventory through a live lookup.

3. 3

   3. Appraise

   The data is assembled locally in Identity_Report.txt, serialized as JSON and posted to the LLM with the system prompt. The call runs from the victim's machine over the victim's own connection, and the answer is saved as AI_Analysis.txt.

4. 4

   4. Exfiltrate

   Archives leave in up to 3 stages: after the theft, after the AI call, and after network enrichment if it produced anything. Talos observed only third-party endpoints and no attacker-owned infrastructure.

The build process matters too. Instead of hardcoding settings, VOLTA uses a template with 6 swappable slots for values such as a Telegram channel and API keys. Talos believes this points to a builder sold to customers, so even a low-skill buyer could receive ranked target assessments in a Telegram inbox. The report does not say how the malware first reaches a PC, so treat claims about a specific delivery method, such as a particular phishing lure or fake installer, as unverified unless they cite new evidence.

What infostealers take and how each item hurts you

Not all stolen data is equal. A session cookie is the most underrated item because it represents a login that already passed your password and second factor. The table maps the categories in the Talos report to practical countermeasures.

Browsers have tried to raise the cost of cookie theft. Starting with Chrome 127 in 2024, Google added App-Bound Encryption on Windows. Google's security blog explains that the older Windows DPAPI protection does not stop a malicious app running as the logged-in user, while the new scheme ties decryption to the app's identity. Talos, however, reports that much of VOLTA's token theft relies on bypassing that protection by launching Chrome with the --headless flag. Browser hardening makes theft noisier and harder; it is not a complete defense on an already infected machine.

Crypto wallet security and account hardening checklist

An infostealer can empty many accounts within minutes of running, so the goal is to make sure a single infection cannot reach everything. These steps are ordered by impact for a typical crypto holder.

1. Split wallets by purpose
   1. Keep long-term holdings on a hardware wallet whose signing keys never touch the PC, and leave only spending money in browser extension wallets.
   2. Never store a seed phrase in a text file, screenshot, cloud drive or email draft. VOLTA actively tries to crack wallet vaults.
2. Upgrade your second factor
   1. CISA's MFA guidance names FIDO/WebAuthn as the only widely available phishing-resistant method and notes that any MFA beats none. Start with your exchange and primary email accounts.
3. Add exchange withdrawal friction
   1. Enable withdrawal address allowlists, extra confirmation for withdrawals and new-device login alerts, so a hijacked session cannot move funds instantly.
4. Prune sessions on a schedule
   1. Review active sessions in Google, Microsoft, Telegram and Discord, end anything you do not recognize, and remove unused connected apps.
5. Treat unknown executables as hostile
   1. Cracked software, game cheats and files sent over chat are common stealer carriers. Google notes that limiting administrator rights forces malware toward more detectable techniques.

News about wallet drainers and phishing campaigns often spreads first in Telegram channels. theddari's Telegram trend pages show which security topics crypto and AI channels are discussing, which can help you notice an active campaign sooner. Confirm any action against official exchange or wallet notices and the original security research; a trend page shows what people are talking about, not whether a file or link is safe.

页面引用

趋势theddari.com›趋势Telegram · 加密货币加密货币频道实时帖子

页面引用

趋势theddari.com›趋势Telegram · AIAI 频道实时帖子

What to do if you suspect an infection

Because VOLTA deletes its own executable, a clean antivirus scan afterwards proves little. Talos recommends preserving the %APPDATA%\volta_debug.txt file, a timestamped harvest log that records exactly what was collected and whether the LLM call succeeded.

1. 1

   Isolate the machine

   Disconnect it from the network and stop signing in on it. Keep logs and suspicious files rather than deleting them.

2. 2

   Recover accounts from a clean device

   Change passwords for email, exchanges and messengers, then sign out all sessions and revoke tokens. Talos explicitly advises revoking potentially compromised tokens.

3. 3

   Move crypto to a brand-new wallet

   If the seed phrase was on disk in plaintext, Talos says to treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device. Re-importing the old seed elsewhere does not help.

4. 4

   Report and document

   Notify your exchange and bank, then file with your national cybercrime authority. In South Korea, KISA's hotline is 118.

Separating hype from what the report shows

Headlines about AI malware can suggest a machine that hacks on its own. The Talos report shows something more mundane and arguably more scalable: the model takes over the most attention-heavy human step, reading huge piles of stolen logs and deciding whom to pursue first. Talos sees the same logic in other AI-integrated implants and calls it effort displacement. A wide net that sorts itself means victims who look wealthy can be targeted faster and with more context.

The report also leaves things out. It does not give infection counts, losses or the initial delivery vector, so be skeptical of articles that supply those numbers without new sources. For individuals, the defenses are the same fundamentals that worked before the AI layer: keep seed phrases off your computer, separate long-term holdings from spending funds, use phishing-resistant MFA, and make session cleanup part of every incident response.