Researchers at Cisco Talos have documented an infostealer that does not stop at theft. After sweeping an infected machine, the malware bundles what it found and asks a large language model to write an intelligence assessment of the person it just robbed.
The sample calls itself Volta internally, and Talos labeled the broader strain Volta-Autodoxer. Wired reported the findings first.
Two passes through a victim
The first sweep collects browser passwords, Microsoft OAuth tokens, cookies, payment cards and wallet seed phrases, plus live Discord, Telegram, Steam and Roblox sessions. A second, deeper pass reads the target’s Gmail for receipts and delivery history from services such as Uber Eats and DoorDash, which together sketch out location, habits and spending.
That dossier goes out through OpenRouter, which can route prompts to several providers. Volta defaults to Anthropic’s Claude Opus 4.6, then falls back to Moonshot’s open-weight Kimi K2 and Google’s Gemini 2.5 Flash if a request is refused. The bundled prompt runs about 240 words and asks for an executive summary covering what the victim does, what they are worth, and how good their operational security is.
Triaging faster than tokens expire
Ryan Fetterman, a Talos researcher, said the prompt is carefully worded to avoid reading as malicious, and that the crew clearly anticipated refusals. The implant still works without any model at all.
The point is speed. Stolen session tokens and passwords have short shelf lives, so surfacing the highest-value targets first improves the odds of cashing in before a reset.
Talos built a framework called CAIRN to spot tools like this, and has not established whether Volta has been used in the wild.
