Overview
Cisco Talos researchers have disclosed VOLTA-AUTODOXER (VOLTA), a Windows infostealer that integrates commercial large language models directly into its post-exploitation pipeline. Unlike conventional stealers that dump raw credentials for manual operator review, VOLTA automatically constructs a structured evidence bundle about each victim and submits it to AI models via the OpenRouter API gateway to produce a prioritised, citation-backed financial dossier. This represents a meaningful escalation: the operator receives analyst-grade intelligence rather than a raw log file.
Technical Analysis
VOLTA harvests a broad credential surface including browser passwords and cookies (Chromium-based), Outlook and Slack data, payment card details, cryptocurrency seed phrases, Discord/Steam/Roblox session tokens, Microsoft OAuth tokens, SSH and cloud provider keys, Wi-Fi profiles, and screenshots.
A distinctive enrichment step uses stolen Gmail session access to query the victim’s inbox for delivery receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal — corroborating home address data through purchase history rather than relying solely on device metadata.
The collected data is serialised into a structured bundle and submitted to OpenRouter with a 240-word system prompt that instructs the model to act as a “forensic intelligence analyst.” The prompt explicitly prohibits the model from supplementing findings with training knowledge — all facts must derive from the bundle alone, a technique that reduces hallucination risk and keeps the dossier legally plausible for fraud operators.
The required output includes:
- WHAT THEY’RE WORTH — valuables ranked low/medium/high by monetisation potential
- THEIR OPSEC — assessment of the victim’s security posture and password hygiene
Multi-model fallback chain: Requests default to Anthropic Claude Opus 4.6; if the response contains refusal phrases such as “I can’t” or “I’m not able,” the malware automatically retries with Moonshot AI’s Kimi K2, then Google Gemini 2.5 Flash. This resilient chaining is a deliberate jailbreak-bypass strategy that treats model safety guardrails as a routing problem.
Exfiltration occurs in three Telegram bursts: immediately after initial credential harvest; after the LLM analysis completes; and after the live Gmail enrichment step. The malware also supports a six-slot build-time template, suggesting a builder/affiliate model.
Framework Mapping
| Technique | Rationale |
|---|---|
| AML.T0047 – AI-Enabled Product or Service | VOLTA uses commercial LLM APIs as a core capability |
| AML.T0054 – LLM Jailbreak | Multi-model fallback explicitly routes around refusals |
| AML.T0065 – LLM Prompt Crafting | 240-word system prompt engineered for forensic analyst persona |
| AML.T0057 – LLM Data Leakage | Victim PII is submitted to third-party AI infrastructure |
| LLM08 – Excessive Agency | LLM is granted autonomous triage and scoring authority over stolen data |
| LLM06 – Sensitive Information Disclosure | PII, financial, and credential data traverses external LLM APIs |
Impact Assessment
The primary risk is operator efficiency amplification: VOLTA reduces the manual effort required to monetise stolen credentials, lowering the skill floor for financially motivated attackers. Victims with high-value crypto holdings, corporate Slack access, or active payment cards are systematically prioritised, accelerating downstream fraud. Secondary risk exists in the data sovereignty dimension — victim PII is transmitted to commercial AI infrastructure outside the victim’s jurisdiction.
Mitigation & Recommendations
- Block or alert on outbound connections to
openrouter.aiand similar LLM API gateways at the firewall or proxy layer — legitimate enterprise workloads rarely require this. - Deploy behavioural EDR rules for VOLTA’s three-stage Telegram exfiltration pattern and mass credential file access.
- Enable Gmail advanced phishing protections and audit active OAuth sessions regularly to limit post-compromise inbox enrichment.
- Enforce phishing-resistant MFA (FIDO2/passkeys) on high-value accounts; session token theft is VOLTA’s primary browser attack vector.
- Monitor for OpenRouter API key usage in process memory or environment variables on endpoints.