What happened
Cisco Talos researcher Ryan Fetterman described VOLTA, which calls itself VOLTA-AUTODOXER, a Windows infostealer that deletes itself after running. It collects browser passwords, cookies and saved payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud keys, Wi-Fi profiles and screenshots.
It then enriches the haul. Using the victim's own Gmail session, it searches the inbox for receipts from shops and delivery services such as Amazon, DoorDash and Uber Eats to confirm a home address, and it values the victim's Roblox inventory.
How the AI step works
VOLTA bundles everything into a profile and sends it to a language model through a third-party API, with a system prompt asking the model to act as a forensic intelligence analyst. The output must rank the victim's valuables by monetization value and assess their security habits. If the first model refuses, VOLTA falls back through a chain of up to three models; Talos lists the default and fallback models by name in its post. The request runs from the victim's own machine, and the stealer works without the AI step if no key is set.
Talos found six slots in the binary that are filled at build time, including the Telegram channel and API keys, and concludes VOLTA is likely sold under a builder model: the author compiles a custom copy for each buyer.
What it means for you
The AI layer does not steal more, but it saves criminals the work of deciding which victims to pursue first, which Talos calls effort displacement. For organizations, Talos suggests restricting which processes may start Chrome with the --headless flag, since VOLTA relies on that to bypass Chrome's App-Bound Encryption, or at least alerting on it.
If a machine is infected, keep the %APPDATA%\volta_debug.txt log, which records what was collected, then revoke tokens and change passwords. Treat any crypto wallet whose seed phrase sat on disk in plain text as lost and move funds to a new wallet.
Go to the source
Sources & further reading
Based on the official documentation below. Features and access can change; check the provider before making a decision.
Was this page useful?
Help us make our coverage more useful. This is feedback on the page, not a rating of the tool.