VOLTA: the new Windows malware that steals your passwords, then asks AI what you are worth
Most computer malware steals your passwords and moves on. A new piece of Windows malware described on Saturday, 31 October 2026, does something different: after taking everything it can find, it sends a profile of you to an AI model and asks the model to work out what you are worth.
The malware is called VOLTA, or VOLTA-AUTODOXER. It was described by Cisco Talos, the threat research team at Cisco, in an analysis published on 31 October. Talos calls it a “mature stealer implant with an optional AI-integration layer”. It is a password thief with an AI step bolted on at the end.
That AI step is what makes VOLTA stand out. The malware does not use AI to break in or to hide. It uses AI to do the thinking a criminal would otherwise have to do by hand: sorting through stolen logins, receipts, chats and wallet files, and turning them into a short, ranked report on which of your accounts are most valuable. Talos says the AI acts as the operator’s “triage analyst”, turning a raw credential log into a prioritised dossier.
At a glance
What happened: On Saturday, 31 October 2026, Cisco Talos published an analysis of VOLTA-AUTODOXER, a self-deleting Windows infostealer that steals passwords, sessions and crypto wallets, then sends a profile of the victim to an AI model to rank the victim’s assets by value.
Why it matters: It is one of the clearest examples yet of AI being built into everyday cybercrime, not to break in, but to sort victims and pick the most profitable ones.
What happens next: Security teams are expected to watch for copycats, and Talos advises restricting how Chrome can be launched and treating any wallet whose seed phrase was stored on an infected computer as fully compromised.
What is VOLTA?
VOLTA is an “infostealer”, a type of Windows malware whose whole job is to quietly gather information from an infected computer. Once it is on a machine, it sweeps everything a person might have stored there.
The list of what it takes is long. It extracts saved browser passwords, cookies and payment cards from Chromium-based browsers such as Chrome and Edge, and it also hits Firefox and Thunderbird. It takes Outlook profiles, Slack workspaces, Microsoft login tokens, and the saved sessions for Discord, Telegram, Steam, Battle.net and Roblox. It also collects SSH keys and cloud-provider configuration files, and pulls every saved Wi-Fi password on the machine in plain text.
It does not stop at copying cryptocurrency wallets. VOLTA runs a built-in cracker against the wallet vault while it is still on the victim’s computer, and records the result on a line headed “WALLET VAULTS CRACKED”. If the wallet’s seed phrase — the master key that controls the money — was stored in plain text on the disk, Talos says the wallet should be treated as fully compromised.
After the theft, VOLTA deletes itself. But it leaves behind a clue: a timestamped harvest log called “volta_debug.txt” in the computer’s application data folder, which records exactly what was collected and whether the AI call succeeded. The sample Talos analysed was a 64-bit Windows program, first seen on 11 October 2026. Talos has not said how it spreads, or who built it.
How the attack works
VOLTA’s attack runs in three stages: steal, enrich, and ask the AI.
Stage one: the theft
The first stage is the broad sweep described above: in a single pass, VOLTA pulls credentials and sessions from browsers, email, chat apps, gaming platforms, work tools and crypto wallets. Much of its power to steal browser login tokens depends on getting around a Chrome security feature called App-Bound Encryption, which locks saved tokens to the browser itself.
Stage two: the enrichment
The second stage is what separates VOLTA from an ordinary password thief: instead of just taking what is there, it uses the stolen sessions to dig deeper into the victim’s life. Using the victim’s own Gmail login, it searches their inbox for purchase receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal, and uses those receipts to confirm the person’s home address. It pulls food-delivery order history directly, reuses the stolen Discord token for more detail from the victim’s Discord account, and checks the value of the victim’s Roblox inventory through a live lookup on Rolimons.com. All of this is assembled locally into a file called “Identity_Report.txt”: a profile of the person built from the digital traces of their daily life.
Stage three: the AI assessment
The third stage is the new part. VOLTA turns the profile into a data bundle and sends it to OpenRouter, a service that gives one connection to many different AI models, with instructions for the model to act as “a forensic intelligence analyst drafting a target assessment”.
The model must produce a section headed “WHAT THEY’RE WORTH”, ranking the victim’s valuables by how easily they could be turned into money, in low, medium and high tiers, and a section headed “THEIR OPSEC”, assessing the victim’s security habits and password hygiene. The prompt even pushes the model to connect scattered clues — for example, linking a victim’s name, address or university to patterns in their passwords.
The malware is set up to keep trying until it gets an answer. Its first choice of model is Claude Opus 4.6, made by Anthropic. If that model refuses — the request is checked for refusal phrases such as “I can’t” — VOLTA falls back to Kimi K2, made by Moonshot AI, and then to Gemini 2.5 Flash, made by Google. The whole AI round trip happens on the victim’s own computer, over the victim’s own internet connection, before anything is sent out. The model’s answer is saved as “AI_Analysis.txt”, and the files are then sent out in stages: a first archive after the theft, a second after the AI call, and a third if the network enrichment produced anything extra.
Why the AI step matters
Criminals have used AI in malware before, usually to write phishing emails or generate fake content. VOLTA uses it differently: the AI is not helping the malware break in or hide, it is doing the desk work. Talos researcher Ryan Fetterman calls VOLTA “a mature stealer implant with an optional AI-integration layer”. The key word is optional: without an AI key configured, the malware still steals everything.
Talos argues that this is a shift in what AI does for criminals. The improvement is not speed or scale, it is what the researchers call “effort displacement”: replacing the step that needs the most sustained human attention with a model call. A criminal who steals a thousand people’s logins would normally have to read through them to find the few victims worth targeting. VOLTA does that reading for them. That lowers the skill needed to run a profitable operation, and raises the ceiling on scale.
Talos also draws attention to a second trend: the malware is built to survive refusals. AI companies put guardrails in their models to stop them helping with crime, and VOLTA is designed with that in mind: if one model refuses, it moves to a smaller, possibly more permissive one, and then to a third. Talos says that as AI is built into more malware, this kind of refusal resilience may become a standard design requirement. There is no evidence the AI models involved were designed for this, or that their makers knew about it.
A builder, not a one-off
One telling detail is how VOLTA is put together. Instead of hard-coding its settings — the messaging channel, the API keys, the configuration — into the program, it uses a template with six slots filled in when each copy is built.
Talos says this points to a “builder” model: the author sells access, the customer supplies their own values, and the builder compiles a custom copy of the malware for each order. If that is right, the AI dossier is a feature sold to customers, not a trick the author built for their own use, and it lets anyone of any skill level receive ranked assessments of their victims.
There is also no attacker-owned infrastructure in what Talos observed. Every endpoint the malware talks to is controlled by a third party — OpenRouter for the AI, Telegram for the results, and legitimate services such as Gmail and Rolimons.com for the enrichment — so there is no single criminal server to seize.
How it was found
VOLTA surfaced through a research effort called CAIRN, short for the Cognitive Artifact Intelligence Research Network. Cisco Talos released and open-sourced CAIRN on 22 September 2026 as a toolkit for hunting, classifying and tracking AI-integrated malware by looking at the traces it leaves behind — embedded prompts, provider endpoints and API keys — without running the malicious programs themselves. Talos said at the launch that it would share its early findings over time, starting with a piece of malware called CLOSEDQUORUM, a fully autonomous system that coordinates several AI models with no human operator. VOLTA is the next finding, and it shows a different use of the same idea: CLOSEDQUORUM used AI to make decisions, while VOLTA uses AI to do analysis.
What is still unknown
For all the detail in the Talos analysis, several basic questions have no answer yet. Talos analysed a single sample, and it has not said how VOLTA spreads, how many people it has infected, who is behind it, or whether it has been used in real attacks at all.
That is important context. VOLTA may be a sign of things to come rather than an active epidemic. The sample was first seen on 11 October 2026, three weeks before Talos published its analysis, and it may have been circulating quietly, or barely used at all. Neither Talos nor the other outlets that covered the research claim to know.
It is also not clear how effective the AI assessment actually is in practice. Talos describes what the malware asks for and how it is built, but it does not publish examples of the assessments the models produced, or say whether criminals have found them useful. Infostealers are already one of the most common kinds of malware, and VOLTA does not change that basic threat. What it changes is what happens after the theft — and, if the idea spreads, how efficiently criminals can pick their best targets from a large haul.
How to protect yourself
The most specific recommendation concerns Chrome. Much of VOLTA’s ability to steal login tokens depends on bypassing Chrome’s App-Bound Encryption by launching the browser in a special mode called “headless”, which runs it without a visible window. Talos says a rule controlling which programs may launch Chrome in headless mode would block that path entirely. For home users, the simpler version is to keep the browser and operating system updated, and to be cautious about what you download and run.
Talos also repeats advice that applies to all password theft: use a password manager rather than saving passwords in the browser, and turn on two-factor authentication, so a stolen password alone is not enough to get in.
If a computer is infected, Talos says the first step is to preserve the “volta_debug.txt” log file, because it records exactly what was taken and whether the AI call succeeded. Then revoke stolen tokens, change passwords, and sign out of affected services. For cryptocurrency, the rule is strict: if a wallet’s seed phrase was stored in plain text on the infected machine, treat the wallet as fully compromised and move the funds to a new wallet, with a seed phrase generated on a device that has never been online.
Frequently asked questions
What is VOLTA?
VOLTA, also called VOLTA-AUTODOXER, is a self-deleting Windows infostealer described by Cisco Talos on 31 October 2026. It steals browser passwords, cookies, payment cards, chat and gaming sessions, cloud keys, Wi-Fi passwords and crypto wallet data, then sends a profile of the victim to an AI model that ranks the victim’s assets by value.
How does the AI part of VOLTA work?
After stealing and enriching the victim’s data, VOLTA sends a structured profile to an AI model through OpenRouter, with instructions to act as a forensic intelligence analyst. The model is asked to produce a “WHAT THEY’RE WORTH” section ranking valuables by how easily they can be turned into money, and a “THEIR OPSEC” section assessing the victim’s security habits. The default model is Claude Opus 4.6, with Kimi K2 and Gemini 2.5 Flash as fallbacks.
Has VOLTA infected many people?
That is not known. Talos analysed a single sample, first seen on 11 October 2026, and says it has not tracked whether the malware has been used in real attacks. There are no published victim numbers.
What should I do if I think my computer was infected?
Preserve the “volta_debug.txt” log file if it exists. Then revoke stolen tokens, change your passwords, and sign out of affected services. If a crypto wallet’s seed phrase was stored in plain text on the machine, treat the wallet as fully compromised and move the funds to a new wallet with a seed generated offline.
Why does VOLTA matter if it has not been seen in the wild?
Because it shows a new pattern: AI being used not to break in, but to sort victims and pick the most profitable targets. Talos says this could lower the skill needed to run a profitable theft operation and raise the scale at which it can run, and similar tricks may appear in other malware next.
How can I reduce the risk from infostealers like VOLTA?
Keep your browser and operating system updated, be cautious about downloads, use a password manager instead of saving passwords in the browser, and turn on two-factor authentication. Keep crypto seed phrases and recovery codes off your computer entirely.
Conclusion
VOLTA is not the biggest malware story of the year, and it may never become one. It is a single sample, with no known victims and no confirmed attacks. But it shows where cybercrime is going: criminals are no longer just stealing data, they are hiring AI to read it, rank it, and tell them who is worth robbing.
The theft itself is familiar. The enrichment — receipts, delivery orders, game inventories — shows how much of a life can be rebuilt from a single logged-in browser. The AI assessment is the new part: a short, ranked report that turns a mountain of stolen data into a to-do list. The lesson is simple: the value of your data is not only in your passwords, but in the picture they paint of you, and that picture is now something criminals are asking machines to draw.
This article is for general information and education only. It is not legal or financial advice.
Sources
- https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ (Cisco Talos, 31 October 2026)
- https://www.unite.ai/cisco-talos-details-volta-infostealers-llm-victim-ranking-stage/ (Unite.AI, 31 October 2026)
