VOLTA Infostealer Uses an LLM to Rank Victims: What Talos Found and What Developers Should Check

Cisco Talos published a write-up on October 31, 2026 of VOLTA, a Windows infostealer that does something unusual after the theft is finished: it hands the loot to a large language model and asks it to work out how much the victim is worth. The model is reached through OpenRouter, the default is anthropic/claude-opus-4.6, and the answer lands in a file called AI_Analysis.txt. Talos says the model acts "as an intelligence analyst on behalf of the operator."

For readers who run AI coding agents, the interesting part is not the LLM stage. It is the list of what VOLTA collects: SSH keys, cloud-provider configuration, Microsoft OAuth tokens, Slack and Outlook profiles. Those are the files that sit on a developer laptop next to Claude Code or Codex. This post covers the chain step by step, what Talos did and did not say, and what to change today. We did not run the sample; everything below comes from the Talos report and secondary context.

TL;DR

What did Talos find?

Talos tracks the sample as VOLTA (VOLTA-AUTODOXER) and found it through CAIRN, its open-source effort to hunt malware that has AI built in. CAIRN was released in September 2026 and has already surfaced other samples, such as CLOSEDQUORUM, a Windows implant that lets four commercial LLMs vote on its actions. We covered a sibling case from the same week in NIK C2 and the OPENAI_API_KEY fallback.

The file is a PE32+ x86-64 executable, compiled on August 17, 2026 and first seen on October 11, 2026 at 12:46 UTC. It deletes itself after running. Talos observed no actor-owned infrastructure: every endpoint it saw was a third-party service. The configuration is protected by a key derived from SHA-256 of two constants in the same binary, which Talos assesses as no real protection. The binary uses a template with six swappable slots filled at build time, which suggests a builder model where customers order their own binaries.

How the attack works, step by step

1. Execution and theft. VOLTA collects browser passwords, cookies and saved cards from Chromium-based browsers, Firefox and Thunderbird. It also takes cryptocurrency wallet seed phrases (an embedded cracker tries to open wallet vaults), Discord, Telegram, Steam, Battle.net and Roblox sessions, Microsoft OAuth tokens, Slack workspaces and Outlook profiles.
2. Developer-relevant files. Talos lists SSH keys and cloud-provider configuration (gcloud, OpenVPN, Hide.me), plus saved Wi-Fi passwords read in plaintext through WlanGetProfileList, screenshots and document authorship metadata.
3. Live enrichment. Using the stolen sessions, VOLTA searches Gmail for merchant receipts to confirm a home address, pulls Uber Eats and DoorDash order histories, reuses Discord tokens to enrich the profile, and values Roblox inventory through a third-party price lookup.
4. Profile assembly. It writes a local Identity_Report.txt with location, employer, inferred birth year and partial card data, serialized as JSON.
5. The LLM call. The JSON goes to OpenRouter (openrouter.ai/api/v1/chat/completions) from the victim's own connection with a generic Mozilla/5.0 user agent, at temperature 0.2 for consistent output.
6. Refusal handling. VOLTA scans the reply for refusal phrases and, if it finds one, moves down the fallback chain: Claude Opus 4.6, then Kimi K2, then Gemini 2.5 Flash. Talos reads this as the author expecting to hit model guardrails.
7. Output. The model produces AI_Analysis.txt with a "WHAT THEY'RE WORTH" section ranking assets by monetization tier and a "THEIR OPSEC" section assessing password hygiene and security posture. The system prompt casts the model as a "forensic intelligence analyst drafting a target assessment" and asks it to be blunt, specific and accurate. The input is Identity_Report.txt, and both it and the output are packaged in volta_dox.zip for exfiltration.

Talos calls this "effort displacement": a model replaces the analyst work that normally follows data theft, so an operator can triage thousands of victims without reading each dump.

Why developers should care

A generic infostealer on a developer laptop is worse than one on a gaming PC. A single ~/.ssh directory can open production hosts and private repositories. A cloud CLI config can hold long-lived credentials. A browser session to a code host or an AI provider console can be reused without a password.

The LLM ranking makes this sharper. An operator who gets a ranked list sees at a glance that one victim has an employer, a cloud account and SSH keys, and spends time on that one. That is the same economic logic as the stolen-key markets we described in the October 2026 AI-led attacks roundup and in Aokigahara, a stealer that went after Claude Code, Codex and Cursor credentials.

There is also a notable detail for anyone who works with Claude: the default model is a commercial, safety-trained one, reached through a router, with open-weight and competing models as fallbacks. Whether the lab can detect and stop that use is a question for providers, not for readers. Readers' controls are on their own machines.

What is confirmed and what is not

We found no independent write-up of VOLTA at the time of writing, so the Talos post is the only detailed source. Treat details as subject to revision.

What this means if you run AI coding agents

The agent is not the weak point here. The machine around it is. Concrete steps:

1. Hunt for the artifacts. Look for volta_debug.txt in %APPDATA%, Identity_Report.txt, AI_Analysis.txt, volta_log.zip, volta_dox.zip, volta_doxnet.zip, and executables named 9BY0tjwOc3ut.exe or yLP9m5J3i2Aw.exe. The SHA-256 is 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279. Keep volta_debug.txt as evidence, since the binary may delete itself.
2. Alert on OpenRouter traffic from processes that are not your own tools. A browser or editor calling openrouter.ai may be normal; an unsigned executable in a temp folder is not.
3. Restrict headless Chrome. Talos recommends application control that limits which processes can launch Chrome with --headless, which blocks the App-Bound Encryption bypass path, and alerting on headless launches from unexpected parents.
4. Use hardware-backed credential storage. Prefer hardware-bound SSH keys and platform credential stores over plaintext key files and long-lived cloud tokens.
5. Rotate on suspicion. Revoke OAuth tokens and sessions, change passwords, replace SSH keys, and treat any wallet with a seed phrase on disk as fully compromised. Our first 24 hours after a vendor breach runbook lays out a rotation order that works for a machine compromise too.
6. Keep secrets out of what agents read. Anything an agent can open can be echoed into a transcript and, on an infected machine, anything your user can open can be stolen. The 26,400 live keys found in public repos post shows how often keys end up in reach.

What Beam can and cannot do here

Beam is not endpoint protection and cannot detect or remove a Windows infostealer. It will not stop VOLTA.

What it helps with is the agent side of the same hygiene. Beam watches what Claude Code, Codex and similar agents do and flags risky actions such as credential exposure, for instance an agent reading ~/.ssh or printing a key file. Where hooks exist (Claude Code and Codex PreToolUse), workspace policy can deny such an action before it runs. Captured events are redacted before storage and stay on-device. The limits: the deny is hook-based, not a kernel sandbox, scanning is heuristic, and missing cached policy fails open. See what Beam watches and how it works.

Where this fits

Attackers now put LLMs in the post-exploitation step as well as in the intrusion. Wiz's seven fingerprints of agentic attacks and Unit 42's Hermes-agent cybercrime case describe the same direction from the incident side. The October 2026 attacks timeline tracks the month's incidents.

The practical lesson is unchanged by the AI layer: the more valuable your machine looks, the more attention it gets, and a model now helps sort it. Reduce what is stored in plaintext, shrink token lifetimes, and watch for unusual processes calling model APIs.

Frequently asked questions

What is the VOLTA infostealer?

VOLTA is a self-deleting Windows infostealer that Cisco Talos described on October 31, 2026. After stealing browser data, wallets, sessions, SSH keys and cloud configuration, it sends a summary of the victim to an LLM through OpenRouter and writes the model answer to a file called AI_Analysis.txt.

Which models does VOLTA call?

Per Talos, the default is anthropic/claude-opus-4.6, with a fallback chain of moonshotai/kimi-k2 and then google/gemini-2.5-flash. The malware checks answers for refusal phrases and moves to the next model when it sees one.

Does VOLTA target AI coding agents?

Talos does not document targeting of agent credentials specifically. It does take SSH keys and cloud-provider configuration, which developers who run coding agents keep on the same machine, so the exposure is real even though the targeting is generic.

Is there a patch I need to install?

No. VOLTA is malware, not a vulnerability in a product. The defenses are application control for headless Chrome launches, hardware-backed credential storage, and rotating everything on a machine you believe was infected.

How do I check whether I was hit?

Search for the file names Talos lists (volta_debug.txt in %APPDATA%, Identity_Report.txt, AI_Analysis.txt, volta_log.zip) and the SHA-256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, and look for OpenRouter API traffic from processes that should not make it.

Related reading

• NIK C2 malware falls back to your OPENAI_API_KEY
• Aokigahara infostealer and agent credentials
• AI-led attacks in October 2026
• First 24 hours after a vendor breach
• October 2026 attacks timeline

Details are accurate as of October 31, 2026, and are based on the Cisco Talos report and press coverage of the CAIRN project. Beam is a local prototype, and Talos may update its findings and indicators after publication.