Cisco Talos Details VOLTA Infostealer’s LLM Victim-Ranking Stage

PUBLISHER ARTICLE PREVIEW

From the original article

Cisco Talos researcher Ryan Fetterman on October 31, 2026 published an analysis of VOLTA-AUTODOXER, a self-deleting Windows infostealer that follows a broad credential-theft pass with a large language model stage designed to rank each victim’s monetizable assets.

Talos describes VOLTA as a mature stealer implant with an optional AI-integration layer, and says every observed endpoint is third-party controlled, with no attacker-owned infrastructure. In Talos’s assessment, the novelty of the AI stage is that the model works as an intelligence analyst on the operator’s behalf rather than supporting a traditional malware capability, converting a raw credential log into a prioritized dossier of the victim’s monetizable assets backed by citations.

The malware surfaced through Talos’s CAIRN research effort. Talos released and open-sourced CAIRN, the Cognitive Artifact Intelligence Research Network, on September 22, 2026 as a toolkit for hunting, classifying, and tracking AI-integrated malware through metadata artifacts such as embedded prompts, provider endpoints, and API keys, without downloading or executing the underlying binaries. Talos said at release that it would share its initial findings over time, beginning with CLOSEDQUORUM, an implant it described as a fully autonomous multi-model consensus orchestrator with no human operator.

A single VOLTA pass extracts browser credentials, cookies, and saved payment cards across Chromium-based browsers, along with Firefox and Thunderbird data, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, Microsoft OAuth tokens, SSH and cloud-provider configuration files for gcloud, OpenVPN, and Hide.me, Wi-Fi profiles, and screenshots. Rather than simply copying cryptocurrency wallets, the stealer runs an embedded cracker against the wallet vault during the same pass and records the outcome on a WALLET VAULTS CRACKED line in its own report.

A direct WlanGetProfileList call dumps every saved Wi-Fi password on the host in plaintext.

A live enrichment pass then reuses the stolen sessions. With the victim’s own authenticated Gmail tokens, VOLTA searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to corroborate a home address.