Infostealer calls commercial AI models to rank victims by payout

Summary

• Cisco Talos documented VOLTA-AUTODOXER, a Windows stealer that sends harvested victim data to commercial AI models.
• The malware queries OpenRouter from the victim's machine, cycling through three models until one answers.
• Talos assesses VOLTA is a builder product sold to other criminals, delivering ready-made target appraisals.

The latest

A Windows infostealer is outsourcing the analyst's job to commercial language models, Cisco Talos reported on 31 October 2026 in research by Ryan Fetterman. The sample, surfaced through the CAIRN effort tracking AI-integrated malware, packages credentials, session tokens and wallet data, then asks a hosted model to rank what the victim is worth. Talos calls the layer an effort shift, not a technical leap.

Details

• The call: According to Talos, the malware issues a hand-built HTTPS request to OpenRouter's chat completions endpoint with no development kit, a generic Mozilla/5.0 browser identifier and a fixed temperature of 0.2, keeping the traffic indistinguishable from ordinary API activity leaving the victim's device.
• The model chain: Up to 3 attempts are made: anthropic/claude-opus-4.6 is the embedded default, followed by moonshotai/kimi-k2 and google/gemini-2.5-flash. The code scans each reply for refusal phrases such as I can't and I'm not able, then moves down a chain Talos describes as smaller and more permissive.
• The key: The OpenRouter API key sits in one of 6 swappable slots in a build template, one of them a Telegram channel, encrypted using a key derived from the SHA-256 hash of two constants inside the file. Talos says this offers no meaningful protection. Without a key, VOLTA runs as a conventional stealer.
• The prompt: The system instruction tells the model to act as a forensic intelligence analyst producing a target appraisal. Input is a bundled JSON file named Identity_Report.txt; output is saved as AI_Analysis.txt. The prompt demands evidence-grounded claims and asks the model to infer links, such as tying names or universities to password patterns.
• The scoring: The first section, WHAT THEY'RE WORTH, ranks victim assets by ease of conversion to cash on a qualitative low/medium/high scale. The second, THEIR OPSEC, rates security posture and password hygiene. Talos published no actual appraisal output and no numeric scoring system.
• What it takes: Before the model stage, VOLTA collects Chromium browser passwords, cookies and saved payment cards, plus Firefox, Thunderbird and Outlook data; session material from Slack, Steam, Battle.net, Discord, Telegram and Roblox; Microsoft OAuth tokens, SSH files, gcloud and VPN configurations; cleartext Wi-Fi passwords and screenshots.
• Wallets and tokens: Cryptocurrency wallets are attacked by a built-in vault cracker, with results logged under WALLET VAULTS CRACKED. Token theft relies on defeating Chrome's App-Bound Encryption by launching the browser with the --headless flag, a behavior Talos recommends defenders alert on.
• Enrichment: The malware searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, queries food-delivery order history, uses a stolen Discord token to add account detail, and prices Roblox inventory via Rolimons. The targeted services are common in the United States.
• The output: Three archives are produced: volta_log.zip for credentials, sessions, wallets, Wi-Fi keys and screenshots; volta_dox.zip for Identity_Report.txt and AI_Analysis.txt; and volta_doxnet.zip for query results. A debug file at %APPDATA%\volta_debug.txt records what was collected and whether the model request succeeded.
• The timeline: The executable carries a compile timestamp of 17 August 2026 and was first observed on 11 October 2026 at 12:46 UTC. Indicators include SHA-256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 and filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe. Talos assesses VOLTA is a builder product shared or sold to other criminals, letting a buyer of any skill level receive sorted appraisals in a Telegram inbox. The malware deletes itself after execution.

Between the lines

Two structural facts limit the usual defensive playbook. Every observed endpoint belongs to a third party, so there is no attacker-owned server to block, and the model request originates from the victim's own machine with a valid key, so a single vendor's refusal only pushes the chain to the next model. That leaves the burden on device controls and credential storage, which is where Talos directs its mitigations.

What's next

Watch whether OpenRouter, Anthropic, Moonshot AI or Google respond, and whether the embedded API keys are identified or revoked. Also watch for defender telemetry on Chrome launched with --headless by processes outside known developer tooling.

Source: Cisco Talos