---
type: "post"
id: "cisco-talos-details-volta-infostealer-that-sends-stolen-225e2d"
slug: "cisco-talos-details-volta-infostealer-that-sends-stolen-225e2d"
title: "Cisco Talos details VOLTA infostealer that sends stolen victim dossiers to LLMs via OpenRouter for ranking"
description: "Cisco Talos describes VOLTA-AUTODOXER, a Windows infostealer that sends a structured dossier assembled from stolen and enriched victim data to an LLM through OpenRouter."
retrieval_nugget: "Cisco Talos describes VOLTA-AUTODOXER, a Windows infostealer that sends a structured dossier assembled from stolen and enriched victim data to an LLM through OpenRouter. The model ranks assets by monetization value and assesses the victim’s security posture. The case shows how generative AI can turn credential theft into targeted criminal triage."
published_at: "2026-10-31"
updated_at: "2026-10-31"
record_date: "2026-10-31"
date_kind: "published_at"
topics: ["claude","gemini"]
entities: ["Cisco Talos","VOLTA-AUTODOXER","OpenRouter","Claude Opus 4.6","Kimi K2","Gemini 2.5 Flash"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "Cisco Talos reports VOLTA’s LLM-based victim profiling and asset ranking, a distinct malware-analysis finding not covered by the archive documents."
prior_refs: []
source_url: "https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer"
source_urls: ["https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:cisco-talos-details-volta-infostealer-that-sends-stolen-225e2d"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/cisco-talos-details-volta-infostealer-that-sends-stolen-225e2d/","markdown":"https://newruntime.com/posts/cisco-talos-details-volta-infostealer-that-sends-stolen-225e2d.md","json":"https://newruntime.com/posts/cisco-talos-details-volta-infostealer-that-sends-stolen-225e2d.json"}
---

# Cisco Talos details VOLTA infostealer that sends stolen victim dossiers to LLMs via OpenRouter for ranking

## Retrieval answer

Cisco Talos describes VOLTA-AUTODOXER, a Windows infostealer that sends a structured dossier assembled from stolen and enriched victim data to an LLM through OpenRouter. The model ranks assets by monetization value and assesses the victim’s security posture. The case shows how generative AI can turn credential theft into targeted criminal triage.

## Summary
Cisco Talos describes VOLTA-AUTODOXER, a Windows infostealer that sends a structured dossier assembled from stolen and enriched victim data to an LLM through OpenRouter. The model ranks assets by monetization value and assesses the victim’s security posture. The case shows how generative AI can turn credential theft into targeted criminal triage.

## What happened
In an analysis published October 31, 2026, Cisco Talos describes VOLTA-AUTODOXER as a self-deleting Windows infostealer with an optional AI integration. The malware first gathers credentials, browser cookies, payment cards, cryptocurrency wallet seed phrases, messaging and gaming sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots. It then builds a structured account of the person behind the infected machine. Talos says the dossier can include a home address, employer and employer domain, inferred birth year, the last four digits of a payment card, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live valuation of a Roblox account.

VOLTA can also use stolen authenticated sessions to enrich what it has collected. Talos describes it querying a victim’s Gmail for purchase receipts from services including Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal, using receipts to corroborate a home address. It can retrieve Uber Eats and DoorDash order histories and enrich a Discord profile with a stolen token. A lookup against Rolimons.com supplies a Roblox inventory valuation. These steps make the collection more than a simple dump of passwords: they assemble context that may help an operator judge how to monetize access.

The malware saves the resulting information locally as `Identity_Report.txt`, serializes it as JSON, and sends it with a system prompt to OpenRouter’s chat-completions endpoint. The prompt casts the model as a “forensic intelligence analyst” and requests a concise assessment, including a “WHAT THEY’RE WORTH” section that ranks valuables by monetization potential and a “THEIR OPSEC” section on security posture and password hygiene. Talos says the response is saved as `AI_Analysis.txt`; the files are packaged for exfiltration. The inference request runs from the victim’s machine over the victim’s network connection before the result is exfiltrated.

Talos identifies `anthropic/claude-opus-4.6` as the default model and a temperature setting of 0.2. The malware checks the response for refusal-like phrases such as “I can’t” or “I’m not able,” then can fall back to `moonshotai/kimi-k2` and `google/gemini-2.5-flash`. The article notes hand-assembled JSON and no SDK. It also describes six configuration slots filled at build time, which Talos interprets as evidence of a builder model in which a customer provides values and receives a customized binary. The supplied analysis does not give a price, deployment count, or measured success rate.

## What the archive adds
This is a new event, not a report about Cisco’s earlier detection-language release. The archive’s [Project Quarry note](https://newruntime.com/posts/cisco-open-sources-project-quarry-a-detection-language-0f4c65/) covers Cisco’s work on detecting multi-step AI-agent attacks, a related defensive concern but a different tool and finding. An earlier Telegram post discussed model role confusion—how instructions, user messages, and tool outputs can blur inside an LLM. VOLTA adds a distinct operational example: a criminal tool uses a model as an analyst over stolen personal data.

## Trend signal
No supplied SITE_PATTERNS thesis directly describes this malware’s use of commercial LLM APIs to prioritize stolen data. The case is relevant to AI security, but it does not establish a broader shift in runtime security boundaries, agent protocols, or model interfaces. No pattern link is warranted.

## Why now
Talos frames the novelty as a post-theft workflow in which AI acts as an intelligence analyst for the operator, rather than supporting a conventional malware capability. The article’s evidence is a concrete implementation, including a refusal-triggered model fallback chain; it does not establish when this technique first appeared or how common it is.

## Why it matters
For security and platform teams, the important change is not that malware can call an LLM, but what it asks the model to do with the output of theft. Combining credentials, receipts, location clues, account histories, and other traces creates a dossier that can help an operator prioritize people and accounts. That raises the potential value of seemingly mundane data and makes authenticated sessions a source of personal intelligence, not merely a route to account takeover.

The fallback chain also shows why a single refusal is not necessarily a durable barrier when an attacker can switch providers. Defenders should treat outbound model API use as a possible part of the post-compromise workflow, and examine what data is exposed when user sessions or machines are compromised. For API providers, the case is a reminder that abuse monitoring cannot rely only on model choice or one refusal response: the same workflow may be retried against another model. Talos documents a specific tool, not evidence that all infostealers now behave this way.

## Limits and uncertainty
Talos’s article describes its analysis of VOLTA-AUTODOXER, but the supplied material does not establish how many victims were affected, how often the AI stage successfully runs, or whether the resulting assessments led to profitable exploitation. The report does not provide a deployment timeline, price, or independent confirmation of the operator’s business model; the builder interpretation is Talos’s inference from the configurable slots. It also does not show that the named models produced accurate rankings, or that provider safeguards were bypassed in every case. The implementation is evidence of a technique, not a measure of its prevalence or effectiveness.

## Skill to build now
Review outbound LLM API traffic in incident-response exercises. Use a test machine and a controlled account to map which application processes can send data to model gateways, what telemetry records those requests, and how investigators would detect a compromised process submitting personal or credential-derived dossiers. Include fallback requests to multiple model providers in the exercise; a blocked first request may not end the workflow.

## Reader takeaway
VOLTA illustrates a practical criminal use of LLMs: enrich stolen records, then ask a model to prioritize the most valuable targets. The actionable security question is therefore not only whether a model refuses a harmful request, but whether compromised software can keep sending sensitive data and retrying across providers.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Gemini](https://newruntime.com/topics/gemini.md): Explore the gemini topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)