VOLTA is a Windows infostealer that lets AI put a price on its victims. On October 31, Cisco Talos published research describing how it works: first it steals passwords, sessions and wallets, then it hands the bundled data to a large model to assess how much a victim is worth and how good their security habits are. What is new is the division of labour: the model does not break in, it only does the most labour-intensive triage for the operator.
After the theft, the model asks what the victim is worth
One VOLTA run covers almost a person's whole digital life: browser passwords, cookies and bank cards; Outlook, Slack, Discord, Telegram, Steam and Roblox sessions; OAuth tokens, SSH and cloud configuration, Wi-Fi passwords and screenshots. It can also crack a built-in cryptocurrency wallet vault. It then enriches the haul with the stolen sessions: confirming a home address from Gmail receipts and pulling food-delivery orders. The material is assembled into Identity_Report.txt and sent to a model through OpenRouter. The prompt asks for two sections: "WHAT THEY'RE WORTH", ranking assets in low, medium and high tiers by how easily they can be turned into money, and "THEIR OPSEC", assessing password habits.
If a model refuses, it tries the next one
VOLTA's model configuration is blunt: it defaults to Anthropic's Claude Opus 4.6 and, on detecting a refusal phrase such as "I can't", falls back in turn to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash, at a fixed temperature of 0.2. Talos says the fallback chain shows the author expected to hit model guardrails. Guardrails have been worked around before: how Claude's text watermark can be bypassed also exploited a parameter-level loophole. The inference happens on the victim's own machine, and the assessment is exfiltrated as AI_Analysis.txt along with the stolen records.
Three things Talos has not established
Do not read the report as evidence of a large outbreak. Talos analysed a single sample, first seen on October 11, and says nothing about how it spreads, how many victims there are, whether it has been used in real attacks, or whether any model actually completed an assessment. Six build-time configuration slots led Talos to infer a "builder sold to buyers" model, but that is only an inference; no attacker-owned infrastructure was found either.
The defences are equally specific: restrict which processes may launch Chrome in headless mode to block the path around Chrome's app-bound encryption, and alert on headless launches by processes that are not known developer tools; store credentials in hardware-backed storage where possible. If compromise is suspected, preserve the volta_debug.txt log first, then revoke tokens and change passwords; a wallet whose seed phrase was stored in plaintext on disk should be treated as fully compromised and migrated with a seed generated on an isolated device. The earlier case of a malicious Claude Code version in the Cursor extension marketplace is a reminder to assume the worst and check any SSH key that may have been touched.
