"VOLTA builds a structured evidence bundle about the person behind the machine," Cisco Talos researcher Ryan Fetterman said.
What VOLTA collects and how it frames victims
Security researchers at Cisco Talos describe VOLTA-AUTODOXER, shortened to VOLTA, as a Windows infostealer that harvests a broad swath of user data and then assembles that raw material into a prioritized, monetizable dossier. The stealer grabs passwords and cookies from Chromium-based browsers; Outlook profile and Slack workspace data; payment cards and cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi‑Fi profiles; and screenshots.
Talos said VOLTA "builds a structured evidence bundle" containing geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and "a live Roblox account valuation." The malware also uses stolen session access to search a victim’s Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal in order to corroborate home addresses.
AI-driven triage: OpenRouter and a multi-model chain
VOLTA serializes the evidence bundle and sends it to an AI service for analysis through OpenRouter, a unified LLM API gateway and routing service. The default model is Anthropic’s Claude Opus 4.6; if that model refuses the request the malware will fall back to Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash. Talos explained the implant uses "a multi-model architecture to fall back resiliently if it hits a model's refusal, checking each response for phrases like 'I can't' or 'I'm not able,' before passing on to a chain of up to three models."
Talos also published the stealer’s 240‑word system prompt, which directs the model to assume the role of a "forensic intelligence analyst" and to draft a target assessment using only the evidence bundle. One explicit line in the prompt reads: "The bundle is the ONLY permissible source of facts; your training knowledge must never supply a fact about the subject." The output must include a section titled "WHAT THEY'RE WORTH" that ranks valuables by monetization (low/medium/high), and a section on "THEIR OPSEC" assessing security posture and password hygiene.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildThree-stage exfiltration over Telegram and build-time templating
Cisco Talos detailed that VOLTA exfiltrates data to Telegram in three distinct stages: immediately after the stealer runs (sending browser passwords, cookies, payment cards, wallets, platform tokens, Wi‑Fi passwords, and screenshots); after the AI call (including the captured data and the LLM’s analysis); and again after a live enrichment step (containing Gmail receipts and order histories).
Tactically, VOLTA binaries are built from a template with six slots filled at build time, including the Telegram channel used for exfiltration, API keys, and other settings. Talos observed this pattern could indicate either a builder kit marketed to customers or a bespoke compilation process the author operates for individual orders. "If VOLTA is indeed a commoditized malware, then the AI dossier capability isn't something the author invented for their own operations," Talos said.
Parallels with NIK C2 and the danger of LLMjacking
Talos' disclosure referenced a separate, recently documented framework called NIK C2 that likewise integrates generative AI into adversary tradecraft. NIK C2—described as a Go-based Windows remote access tool—provides persistent control and more than 52 commands for collection and exploitation. Talos noted NIK C2 integrates an OpenAI client and can abuse a victim's OpenAI API key if one is present; otherwise it scans environment variables for the string "OPENAI_API_KEY" and uses it to run AI-driven analysis.
Talos called this behavior a form of "LLMjacking," where actors steal access to another party's AI model to run operations while the legitimate account funds the compute. Talos warned the fallback to a victim-stored API key is "a deliberate design with significant operational implications" that can obscure attribution and shift costs to the victim. Zscaler ThreatLabz added that generative AI is well suited to examine massive amounts of data for classification and content searching—capabilities adversaries can weaponize to find sensitive data once access is obtained.
What this means for security teams, enterprises, and end users
- Security teams and technologists should note the dual signals: AI-model endpoints (OpenRouter, Claude Opus 4.6, Kimi K2, Gemini 2.5 Flash) appearing in post‑infection traffic and repeated Telegram exfiltration stages. Talos’ description ties specific telemetry (model fallbacks, Telegram channels, template slots) to the malware's workflow.
- Enterprises and procurement leaders will face a choice about adversaries’ growing ability to turn raw credentials and session tokens into prioritized dossiers; Talos said the AI layer "relieves the operator of analytical work," lowering the skill needed to monetize compromise.
- End users and administrators should be aware the threat includes live enrichment steps—searching Gmail for receipts and using local environment variables such as "OPENAI_API_KEY"—that can increase the operational value of a single compromised endpoint.
VOLTA illustrates a specific trend: codifying post‑compromise analysis with generative models and packaging it as an operational feature. Talos’ reporting links named LLMs, a concrete system prompt, and a Telegram-based exfiltration pipeline to a single family—leaving defenders with distinct artifacts to hunt for and adversaries with a new, automated way to rank victims by cash value.
