INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Volta infostealer asks AI for victim worth via compromised networks

| 2026-11-02 18:34 MEDIUM HIGH AI-ENABLED ATTACK DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
On November 2, 2026, a new Windows infostealer called VOLTA-AUTODOXER surfaced through the CAIRN research effort. The malware is an AI-powered infostealer that steals personal data and uses large language models to assess victims' value and rank targets for attackers. It affects Microsoft OAuth tokens, SSH keys, cloud service credentials, screenshots, and all saved Wi-Fi passwords from Chromium browsers, Firefox, Thunderbird, Outlook, Slack workspace information, login sessions from Discord, Telegram, Steam, Battle.net, and Roblox. The malware creates a file called [IOC HIDDEN • LOGIN REQUIRED], receives the AI's response in [IOC HIDDEN • LOGIN REQUIRED], and sends both files together in a ZIP archive called [IOC HIDDEN • LOGIN REQUIRED]. After running, VOLTA deletes itself without using servers controlled by the attacker but instead uses third-party systems to carry out its activities.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables 6 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 6 IoCs Create Free Account
files 6
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope financefinance cryptocurrencycryptocurrency
Incident Timeline
‎November 02, 2026
Threat actors used VOLTA, an AI-powered infostealer that steals personal data and uses LLMs to assess victims' value, to target individuals.
infrastructure Windows
Cisco Talos has analyzed a new Windows infostealer called VOLTA, which calls itself VOLTA-AUTODOXER.
A new malware self-named “VOLTA-AUTODOXER,” surfaced through the CAIRN research effort , is a self-deleting Windows infostealer that augments its post-theft workflow with an LLM-powered victim-profiling stage.”
industry Finance
General Document Context
industry Cryptocurrency
General Document Context
organisation Identity_Report.txt
The malware creates a file called Identity_Report.txt, receives the AI’s response in AI_Analysis.txt, and sends both files together in a ZIP archive called volta_dox.zip.
organisation Chromium
It collects browser passwords, cookies and saved payment card details from Chromium browsers, as well as data from Firefox, Thunderbird and Outlook.
organisation Slack
It also steals Slack workspace information and login sessions from Discord, Telegram, Steam, Battle.net and Roblox.
organisation Discord
It also steals Slack workspace information and login sessions from Discord, Telegram, Steam, Battle.net and Roblox.
organisation Telegram
It also steals Slack workspace information and login sessions from Discord, Telegram, Steam, Battle.net and Roblox.
organisation Battle.net
It also steals Slack workspace information and login sessions from Discord, Telegram, Steam, Battle.net and Roblox.
organisation Microsoft
The malware also collects Microsoft OAuth tokens, SSH keys, cloud service credentials, screenshots and all saved Wi-Fi passwords.
organisation Amazon
It searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls order histories from Uber Eats and DoorDash, and adds detail to the victim’s Discord profile.
organisation DoorDash
It searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls order histories from Uber Eats and DoorDash, and adds detail to the victim’s Discord profile.
organisation Walmart
It searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls order histories from Uber Eats and DoorDash, and adds detail to the victim’s Discord profile.
organisation PayPal
It searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls order histories from Uber Eats and DoorDash, and adds detail to the victim’s Discord profile.
organisation OpenRouter
The bundle goes to OpenRouter, a routing service for AI models, with a system prompt that tells the model to act as a forensic intelligence analyst drafting a target assessment.
organisation Google’s
If the model refuses, which VOLTA spots by scanning replies for phrases like “I can’t” or “I’m not able”, it moves on to Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash.
organisation App-Bound Encryption
For defense, Talos suggests an application control policy that restricts which processes can launch Chrome with the –headless flag, which would block the App-Bound Encryption bypass.
‎2026/11/02
…uches next.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, malware) facebook linkedin twitter AI Artificial Intelligence Cybercrime Hacking hacking news information…
organisation Security News
…uches next.” Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, malware) facebook linkedin twitter AI Artificial Intelligence Cybercrime Hacking hacking news information security news IT Information Security LLM malware Pierluigi Paganini Security Affairs Security News VOLTA inf…
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Cisco Talos has analyzed a new Windows infostealer called VOLTA, which calls itself VOLTA-AUTODOXER.
A new malware self-named “VOLTA-AUTODOXER,” surfaced through the CAIRN research effort , is a self-deleting Windows infostealer that augments its post-theft workflow with an LLM-powered victim-profiling stage.”
Intelligence Sources
Security Affairs 2026-11-02