Talos says VOLTA stealer has an LLM rank victims' assets and falls back across 3 models; one sample listed
Cisco Talos says its VOLTA stealer posts a bundle of stolen data to a model that ranks the victim's assets by monetisation value, trying up to three models if one refuses. The post lists one sample and gives no victim count, delivery method or loss.
By Parminder Kumar Sharma · LinkedIn · · 16 min read
One sample is listed, and it is the whole evidence for a stealer that asks a model what you are worth
Cisco Talos's post on a Windows stealer it calls VOLTA lists one sample: one SHA256 hash, two filenames, a PE timestamp of 17 August 2026 and a first seen time of 11 October 2026 at 12:46 UTC. Talos published on 31 October 2026, 20 days after that first sighting (derived: 11 to 31 October), and the compile timestamp sits about 55 days before the first sighting (derived from the two dates). Everything below about a model ranking victims rests on what Talos read out of that one binary. The Talos post was published on 31 October 2026 and read here from about 14:50 UTC the same day.
What Talos says the binary does is specific. After stealing credentials, sessions and cryptocurrency wallets, it serialises a structured evidence bundle about the person behind the machine and posts it to a model through OpenRouter, asking for the victim's assets ranked by monetisation value. If a model refuses, it tries a chain of up to three models. Talos says the novelty is that the AI layer is not a traditional malware capability but is "working as an intelligence analyst on behalf of the operator".
What that record does not establish matters as much. The post gives no victim count, no campaign, no delivery method and no loss. It does not say whether the sample was seen on a victim's PC or only in a research collection. It does not say that any ranking changed what an operator did, that any model refused a request, or that OpenRouter or a model provider was told or acted. It names no actor. Talos's reading that the fallback chain implies a direct engineering effort is an inference, not an observed refusal.
What VOLTA does, in the order Talos describes it
Talos describes VOLTA, which calls itself VOLTA-AUTODOXER, as a self deleting Windows stealer found through its CAIRN research effort. In one pass it takes browser passwords, cookies and saved payment cards from Chromium based browsers, and data from Firefox, Thunderbird and Outlook, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, and SSH and cloud provider configuration files. It does not only copy wallets: Talos says it runs an embedded cracker against the vault inline and writes the result to a line it names WALLET VAULTS CRACKED. Every saved Wi Fi password is dumped in plain text.
The part Talos says sets VOLTA apart is what comes after collection. A live enrichment pass uses the stolen sessions. With the victim's own authenticated Gmail tokens, it searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address. Stolen Uber Eats and DoorDash sessions are called for order history, the Discord token is reused to enrich the account profile, and Roblox inventory is valued through a live lookup on Rolimons. The result is compiled locally into a file Talos names Identity_Report.txt.
That file is serialised as JSON and posted to OpenRouter along with a system prompt, and the reply is saved as AI_Analysis.txt. Talos describes three send stages by Telegram: volta_log.zip after the stealer runs, volta_dox.zip after the model call, and volta_doxnet.zip if the network enrichment produces anything. Talos describes the stealer as self deleting. One detail Talos stresses: the inference round trip "happens entirely through the victim's own network connection", on their own machine, before the result is sent on.
The model step: what goes in, which models, what comes back
Talos lists the contents of the bundle as geolocation and home address, employer and employer domain, an inferred birth year, the last four digits of cards, Slack workspaces, document authorship metadata, iPhone backup indicators and a live Roblox account valuation, plus whatever the enrichment pass added. It prints no real bundle. The system prompt, which Talos shows only as an image, casts the model as an analyst preparing a target assessment, and, in Talos's account, asks it to connect scattered fields, for example names, addresses or universities to patterns in the victim's passwords. Talos's reading is that the model is not asked to find data but to stretch it into useful inferences. This site describes the prompt in general terms and does not reproduce it.
What comes back is a report in a fixed shape. Talos says it must include a section on what the victim is worth, with valuables ranked and a low, medium or high tier, and a section assessing the victim's security posture and password hygiene. Its Figure 8 lists ten sections, from an executive summary to a closing section titled Not established. The shape matters: Talos says the assessment is meant to be backed by an auditable trail of citations, so it reads as a dossier rather than a chat reply.
The model chain is the part of the story that travelled furthest in the headline, so here it is as Talos prints it.
The model chain as printed by Cisco Talos, 31 October 2026 (post text, and Figures 2 and 3). Identifiers are quoted exactly; the endpoint is reached through OpenRouter, not through each provider directly.
| Position | Identifier as printed | What the post says |
|---|---|---|
| 1, default | anthropic/claude-opus-4.6 | Default model, hardcoded in the binary |
| 2, first fallback | moonshotai/kimi-k2 | Tried if the first model refuses |
| 3, second fallback | google/gemini-2.5-flash | Tried if the second also fails |
How does it decide to move to the next model? Talos says VOLTA checks each response for refusal phrases such as I can't or I'm not able, and Figure 9 adds a thin response as a trigger. Talos reads the design as the operator anticipating refusals, with the fallbacks "a few, smaller, and more permissive models", and as "implying a direct engineering effort and expectation of hitting model guardrails". Those are inferences. The post prints no test showing that either fallback model complies where the first refused, and no log of a refusal. The temperature is 0.2, which Talos reads as a wish for accuracy and consistency.
Two other facts about the call matter to a defender. The request is hand assembled JSON with no SDK and a browser style User-Agent header, so it does not look like a library. And the call needs a key. Talos says VOLTA is built from a template with six swappable slots, filled in at build time, in place of a hardcoded Telegram channel, API keys and settings, and reads that as a builder model where the customer supplies their own values. With no key present, the stealer can run without the model stage. The slot values are encrypted, but Talos says the key is a SHA256 of two constants in the same binary and that anyone who reverses the file can recover them. So a key is recoverable from a sample. The post does not say any provider was told.
No attacker owned infrastructure, and a stealer that deletes itself
Talos says every endpoint it observed is third party controlled and that no actor owned infrastructure exists. Read with its figures, that means the traffic goes to services that are legitimate on their own terms: OpenRouter for the model call, Telegram for the files, and, as Figure 9 draws them, geolocation lookups and Rolimons for the Roblox valuation. The comforting version of the phrase is that there is no attacker server to find. The practical version for a defender is the opposite: there is no bad domain to block, so a block list built from this report would be a handful of legitimate service names.
That moves detection from where traffic goes to who is sending it. An office laptop with no developer role that posts a JSON request to a model aggregator, or a process other than a chat client that uploads a zip to a messaging service, is the signal. Both are this site's reading of the post, not Talos advice. The post also says nothing about whether OpenRouter, Telegram or the model providers were told, whether any Telegram channel or key was shut, or how long the Telegram side stays live.
Self deletion has a forensic edge. Talos says the main executable may have deleted itself, so a responder may find no sample on disk. It does not describe how the deletion works. What it says remains is a timestamped harvest log, volta_debug.txt under the user's application data folder, which Talos describes as recording exactly what was collected and whether the model call succeeded. Preserve it before any reimage: it is the scoping record, and the post's only pointer to whether a given machine reached the model stage.
Stated and not stated: the record, line by line
What the Cisco Talos post of 31 October 2026 states and does not state, read the same day. Quoted names are as printed.
| Question | Stated by Talos | Not stated |
|---|---|---|
| How many samples | One SHA256, two filenames, PE timestamp 2026-08-17 20:35, first seen 2026-10-11 12:46 UTC | A second sample, a campaign, a build count or a victim count |
| Where it was found | Surfaced through the CAIRN research effort | Whether it was seen on any victim PC |
| How it arrives | Nothing | Delivery, loader, lure or infection route |
| What the model is sent | Categories of field, from home address to a Roblox valuation | A real bundle, field names or sizes |
| What comes back | A ten section report with valuables ranked low, medium or high | A real reply, or whether the ranking is accurate |
| Which models | Three identifiers, reached through OpenRouter | Whether any request was ever refused, or what a fallback returned |
| Providers | Nothing beyond the names | Whether OpenRouter or any model provider was told, acted or revoked a key |
| Losses | Nothing | Any account takeover, theft or sale that followed a ranking |
| AI against a rules based sort | That the model works like an analyst and displaces effort | Any comparison, or evidence the model beats a simple sort |
| Who is behind it | The template suggests a builder model where the author sells access | A name, a seller, a price or a customer |
| Self deletion | The stealer is self deleting and may have deleted itself | How the deletion works |
The record also carries a warning from Talos's own earlier post. Introducing CAIRN, the toolkit through which VOLTA surfaced, Talos wrote that "CAIRN is a research effort, not a pure active threat signal". That does not make VOLTA small, but it says a finding from a metadata first hunt is a lead about a design, not a measure of how many people were hit.
Technical details
Talos's post prints one sample hash, the model call settings, the names of its output files and the log path. It prints no domain list beyond the endpoint and the Rolimons lookup, and no ClamAV, Snort, YARA or MITRE ATT&CK identifiers. At the time of this read the Cisco-Talos IOCs repository listing for October 2026 held four indicator files for other posts and none for VOLTA (listing, read 31 October 2026). Every block below is copied exactly from the post or marked as drawn or derived, and none contains a credential or working code.
The sample. This is the one hash Talos lists. Check it against your endpoint telemetry and your threat intelligence platform; a hash match proves a match to this one build, and a builder model means other builds will differ.
SHA256
57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
Filename
9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe
Type
PE32+ x86-64
PE Timestamp
2026-08-17 20:35
First Seen (UTC)
2026-10-11 12:46
The model call settings. This is the table Talos prints for the AI configuration. The URL is defanged as Talos prints it. A defender uses it to write a proxy or DNS rule that alerts on this endpoint from machines with no reason to reach it.
Endpoint
https[:]//openrouter[.]ai/api/v1/chat/completions
Default model
anthropic/claude-opus-4.6
Fallback chain
moonshotai/kimi-k2 → google/gemini-2.5-flash
Temperature
0.2, deterministic, consistent output
Request format
Hand-assembled JSON; no SDK; User-Agent Mozilla/5.0
Files and paths. The three zip names are the three send stages; the debug log is what Talos says to preserve. The percent sign before APPDATA is missing in the post's own text, which this site reads as the usual environment variable form.
Identity_Report.txt assembled locally, serialised to JSON and posted with the system prompt
AI_Analysis.txt the returned payload (spelled AL_Analysis.txt in Talos's Figure 9)
volta_log.zip send 1, after the stealer runs
volta_dox.zip send 2, after the AI call
volta_doxnet.zip send 3, if the network enrichment produces anything
APPDATA%\volta_debug.txt timestamped harvest log; preserve it
Behaviours and strings named in the text. The Chrome launch option is the one Talos tells defenders to restrict, to block the App Bound Encryption bypass it describes. The other two are strings and a Windows call Talos names.
WALLET VAULTS CRACKED
WlanGetProfileList
--headless
Items that appear only in Figure 9. These are transcribed by this site from the image, not copied from text, so treat spelling as the figure's: the service name in the second line is spelled that way in the figure.
CreateMutexA
vt_udd_N
ip-api.com
api.ipfy.org
Rolimons[.]com
A starting hunt list, derived. Assembled by this site from the artifacts above. Expect false positives from legitimate developer use of model aggregators and from users of Telegram, so scope the rules to machines and roles where neither has a business reason.
Process and network (derived from the post, not published by Talos)
A process other than a known developer tool posting JSON to https[:]//openrouter[.]ai/api/v1/chat/completions
chrome.exe started with --headless by a parent process not on a known developer list
A process other than a chat client sending a zip to Telegram
Files (names as printed by Talos)
Identity_Report.txt, AI_Analysis.txt, volta_log.zip, volta_dox.zip, volta_doxnet.zip
APPDATA%\volta_debug.txt
Not reproduced here: Talos's Figure 4, which shows the system prompt, and the Wi Fi and food delivery screenshots in Figures 5 and 7. This site does not print prompt text, and the two screenshots add nothing a defender can act on.
What to do, in the order worth doing it
Talos's own advice is short: "Revoke any potentially compromised tokens and change passwords", treat a plaintext seed phrase as compromised, and restrict the Chrome launch path. The order below builds on that and marks where this site adds to it. A stealer's haul is mostly sessions, tokens and keys, so killing those comes before resetting passwords.
Take this with you
Ranked checklist for a machine where VOLTA, or any stealer, may have run
- Revoke sessions and tokens first, then change passwords. The haul Talos lists includes Microsoft OAuth tokens, SSH and cloud provider keys, Gmail tokens used live, and Discord, Telegram, Steam and Roblox sessions. Sign out of every session, rotate cloud and SSH keys, and revoke OAuth grants.
- Preserve APPDATA%\volta_debug.txt, and an image of the machine, before cleaning up. Talos says it records what was collected and whether the model call succeeded, and the executable may have deleted itself.
- Treat any seed phrase that was in plaintext on disk as compromised, and move funds to a new wallet whose seed was generated on an air gapped device, as Talos advises. Talos says VOLTA runs a cracker against wallet vaults, so a vault with a weak passphrase is probably not safe either (this site's inference).
- Close the Chrome path Talos describes: an application control policy that limits which processes may start Chrome with the headless option, and an alert when Chrome starts with that option from a process not on a known developer list. Move stored credentials into hardware backed stores where you can.
- Hunt outbound traffic by role. Alert on model aggregator and model API endpoints, starting with the OpenRouter endpoint Talos prints, from machines whose users have no developer or analyst job, and on zip uploads to messaging services from processes that are not the chat client. This is this site's reading of the post, not Talos advice.
- Review mailbox and delivery app activity for the account. Talos says stolen Gmail tokens were used to search the inbox for receipts to confirm a home address, so look in your mail audit logs for searches and sign ins that the user did not make. This is derived from the post.
- Tell the person. The bundle Talos describes holds a home address, an employer and a card ending, so the user may be a target for follow up by phone, mail or in person. The post does not say any follow up occurred.
- If your team recovers a sample, handle any API key in it as evidence and tell that key's provider through its abuse channel. Talos says the slot values are weakly protected and recoverable, and says nothing of a provider being told.
The question that exposes the gap
Talos ends on "a wide net that sorts itself", and asks which phase of an attack a model call will take over next. A narrower question sits closer to a security lead's desk. If a stealer ran on one of your people's machines tonight and a model ranked what that person is worth, which of their sessions, tokens and keys would sit at the top of the list, and could you revoke that one within the hour? The post proves nothing about how often it happens. It does show that the sorting step is cheap to add, and that the work left to a defender is the same as before: know which of your people's tokens are worth stealing, and be able to cancel them fast.
Related briefings on this site: Talos on the NIK C2 implant that calls OpenAI from the victim PC, the CLOSEDQUORUM implant that asks up to four models (the Talos post that VOLTA's conclusion points to) and Symantec on the Aoki infostealer and the AI products it targets.
Key facts
Sources
- PrimaryAppraisal by AI: Model-driven victim prioritization in the VOLTA infostealer, 31 October 2026. The primary, read in full and re-read: the opening, the AI configuration table, the stealer capabilities, the enrichment pass, the deployment model, countermeasures, conclusions, sample details and Figures 1 to 9. Figures 3, 6 and 9 usedCisco Talosaccessed 2026-10-31
- PrimaryIntroducing CAIRN: Frontier tracking for AI-integrated malware, 22 September 2026: the metadata first hunting toolkit through which VOLTA surfaced, and its statement that CAIRN is a research effort, not a pure active threat signalCisco Talosaccessed 2026-10-31
- PrimaryThe Closed Quorum: Inside the first reported autonomous AI C2 implant, 22 September 2026: the post that VOLTA's conclusion points to for the same effort displacement logicCisco Talosaccessed 2026-10-31
- PrimaryDirectory listing of the Talos indicator repository for October 2026, read 31 October 2026: four indicator files for other posts and none for VOLTACisco Talos (GitHub, Cisco-Talos/IOCs)accessed 2026-10-31
