Cisco Talos found an infostealer that asks Claude what its victim is worth
Talos documents VOLTA-AUTODOXER, a stealer that sends a victim dossier to Claude and fails over on refusal. The guardrail response is the interesting half.
Vlad Makarovreviewed and published
Cisco Talos published research on Saturday describing a Windows infostealer that ends its run by sending a dossier about its victim to an AI model and asking the model what that person is worth. The sample names itself VOLTA-AUTODOXER. None of the individual steps is a capability a patient human operator lacked; what the model removes is the analytical shift that used to follow the theft, and Talos is unusually careful to say so.
The stealing is the well-trodden half
The write-up, by Ryan Fetterman, spends its first section on collection, and the list is long: browser passwords, cookies and saved cards, wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud provider keys, every saved Wi-Fi profile, and screenshots. Wi-Fi passwords are pulled through a direct call to WlanGetProfileList and written to disk in plaintext, and an embedded cracker runs against wallet vaults inline.
Then the interesting part begins. VOLTA assembles what Talos calls an evidence bundle about the person behind the machine: geolocation and home address, employer and employer domain, an inferred birth year, the last four digits of payment cards, Slack workspaces, document authorship metadata, indicators that an iPhone backup exists, and a current valuation of the victim's Roblox account. It fills the gaps with the sessions it has just stolen. The victim's own Gmail token is used to search the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal, confirming a home address from a source the victim trusts. Uber Eats and DoorDash sessions are queried for order history, the Discord token is spent on enriching the account profile, and Roblox inventory is priced through a live lookup against Rolimons.
An appraisal written to a brief
The bundle is serialised to JSON, saved locally as Identity_Report.txt, and POSTed to OpenRouter's chat completions endpoint. The system prompt, quoted in the Talos analysis, tells the model to act as "a forensic intelligence analyst drafting a target assessment". The required output has a section headed WHAT THEY'RE WORTH, ranking valuables by how easily they convert to money across low, medium and high tiers, and a second headed THEIR OPSEC that assesses security posture and password hygiene. The reply is stored as AI_Analysis.txt.
That the model is asked to rank rather than to find is the detail worth sitting with. Talos notes the prompt pushes for connections between sparse facts, such as patterns linking a name, an address or a university to the passwords beside them. The raw material was already on disk. The product is a priority order, and a priority order is what an operator with a pile of compromised machines and one evening actually needs.
Refusal treated as a routing failure
The configuration is where the report stops being a story about malware and becomes a story about model access.
| Setting | Value |
|---|---|
| Endpoint | OpenRouter chat completions |
| Default model | anthropic/claude-opus-4.6 |
| Fallback chain | moonshotai/kimi-k2, then google/gemini-2.5-flash |
| Temperature | 0.2 |
| Request format | hand-assembled JSON, no SDK, browser User-Agent |
After each call the code looks for refusal phrases, including "I can't" and "I'm not able", and moves to the next model in the chain when it finds one, up to three attempts. This was built on purpose. A refusal is not an obstacle to be talked around; it is a response class with a handler, treated the way the same code treats a timeout. If no API key is present at all, the stealer skips the analysis stage and exfiltrates what it has.
Read that as a comment on safety training rather than on any single vendor. A refusal is a strong signal in a chat window where the user has one turn and no patience. Against a client that can retry and reach another provider, it behaves like an availability problem, and availability problems get engineered out. The ordering of the chain concedes as much: the most capable model is asked first, and the cheaper, more permissive ones absorb whatever it declines.
The inference bill lands on the victim
Everything above happens on the compromised machine, over the victim's own network, before anything is sent to the operator. That design choice changes the economics in ways that have nothing to do with model capability. The operator does not host the inference, does not pay for it, and needs no account relationship that a provider could suspend on the basis of a traffic pattern. The requests leave from an ordinary residential or office connection belonging to the person being profiled.
Exfiltration is staged in three archives, which maps onto the workflow: volta_log.zip after the steal, volta_dox.zip after the model's reply, and volta_doxnet.zip when the enrichment calls returned anything. A defender who sees only the first archive is looking at a commodity infection. Whether the model call ever happened is a separate question with a separate answer.
A kit with six slots
The binary is not bespoke. It is built from a template with six swappable slots filled at compile time, which reads as a builder arrangement: the author sells access, the customer supplies their own channel, keys and settings, and receives a binary compiled for them. Those slot values are encrypted, but the key is the SHA-256 of two constants sitting in the same file, so the encryption exists to meet a customer's expectation rather than to stop anyone who opens the executable.
Every endpoint observed in the sample is third-party controlled, with no infrastructure belonging to the actor. That points to a capability sold as a feature rather than a tradecraft advantage. A customer with no analytical skill buys a build and receives ranked target assessments in a Telegram chat.
The numbers Talos does not give
There is no victim count here, no estimate of prevalence, and no attribution. One sample is documented.
| Field | Value |
|---|---|
| SHA256 | 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 |
| Filenames | 9BY0tjwOc3ut.exe, yLP9m5J3i2Aw.exe |
| Type | PE32+ x86-64 |
| PE timestamp | 2026-08-17 20:35 |
| First seen | 2026-10-11 12:46 UTC |
The framing offered is more useful than a prevalence figure would be. The axis of improvement, in Talos's words, is effort displacement rather than speed or scale: find the step that needs the most sustained human attention and replace it with a model call. It compares the pattern to CLOSEDQUORUM, the autonomous command-and-control implant the company documented in September through the same CAIRN programme, and leaves open whether this lowers the operational floor, raises the ceiling on scale, or does both at once. That is a fair place to leave it. A wide net that sorts itself is a different object from a wide net, and nobody has measured how different.
What a defender can check
The hardest part of VOLTA to replace is its access to Chrome's App-Bound Encryption, and that is where the most concrete control sits: a policy deciding which processes may launch Chrome with --headless closes the decryption path outright. Failing that, an alert on headless Chrome started by an unfamiliar parent process is cheap and specific. Hardware-backed credential storage limits what a stealer can lift in the first place.
After an infection the executable may have deleted itself, which makes the leftovers worth more than usual. Talos recommends preserving APPDATA%\volta_debug.txt, a timestamped log of what was harvested and whether the LLM call succeeded, then revoking tokens, changing passwords, and treating any wallet whose seed phrase sat unencrypted on disk as gone. That last instruction is not a precaution. It is the only honest advice available once a seed has been read.
The uncomfortable reading of the whole report is that the AI stage adds little to what a determined intruder could do by hand, and that this is why it will spread. The barrier it removes is not skill at stealing but willingness to spend an evening reading a stranger's delivery receipts. Talos closes by asking which phase of an intrusion gets displaced next. Given how much of an operation is paperwork, the answer is probably most of it.
