Cisco Talos’s October 31, 2026, analysis describes a Windows infostealer whose optional AI step follows data collection: the sample gathers and enriches stolen information, then routes a structured dossier through OpenRouter to hosted models for victim assessment. Talos’s technical analysis details that workflow and sample-specific clues for defenders.
What the VOLTA-AUTODOXER sample does
Talos describes a sample that can collect browser credentials, cookies, payment-card data, account sessions, tokens, Wi-Fi profiles, wallet data and screenshots. It can also use stolen sessions to enrich the haul, including searching Gmail for purchase receipts and checking Uber Eats and DoorDash order histories. These are capabilities Talos identified in the analyzed sample, not a claim that every infection collects every type of data.
The dossier is assembled before the AI assessment. Talos describes local files named Identity_Report.txt and AI_Analysis.txt, along with staged archives named volta_log.zip, volta_dox.zip and volta_doxnet.zip.
The assessment uses a large language model (LLM) to evaluate a target’s assets for potential monetization and review operational security, or OPSEC. Talos says the sample routes its requests through OpenRouter, using Claude Opus 4.6 by default, then Kimi K2 and Gemini 2.5 Flash as fallbacks. The prompt is 240 words. The AI stage is optional; Talos says the malware can function without it.
What Talos says defenders can monitor
Talos flags Chrome launches with the --headless command-line option as relevant to the sample’s path around Chrome’s App-Bound Encryption. It recommends monitoring or restricting that behavior. Talos also identifies %APPDATA%\\volta_debug.txt as a timestamped log of harvested data.
If a VOLTA infection is suspected, Talos recommends preserving that log, revoking potentially compromised tokens and changing passwords. If a cryptocurrency wallet’s seed phrase was stored in plain text, Talos advises treating that wallet as compromised and moving funds to a new wallet whose seed phrase was generated on an air-gapped device.
What is known about the sample’s use
WIRED reported on October 31, 2026, that Talos researcher Ryan Fetterman said the team had not tracked whether VOLTA was used in the wild. The analysis describes the sample’s capabilities; its listed first-seen time, October 11, 2026, does not tell when or whether a victim was infected.
