Cisco Talos’s CAIRN research team has published a technical teardown of a Windows infostealer that outsources part of its own analysis to a commercial AI model. The malware calls itself “VOLTA-AUTODOXER” in its own code, and Talos published its findings on 31 October 2026.
After it harvests credentials and other data from an infected machine, VOLTA builds a bundle of what it stole. It sends that bundle to an AI model, asking it to rank the victim’s stolen assets and judge the victim’s security habits. Talos says the malware’s default configuration routes that request through OpenRouter to Anthropic’s Claude Opus 4.6. If that model refuses to answer, VOLTA fails over to Moonshot AI’s Kimi K2, then to Google’s Gemini 2.5 Flash.
- Self-named.
- VOLTA-AUTODOXER.
- Found by.
- Cisco Talos’s CAIRN research team, 31 Oct 2026.
- Platform.
- Windows, deletes itself after it runs.
- Distribution.
- A builder sold to customers, not one group’s own tool.
- Primary model called.
- anthropic/claude-opus-4.6, via OpenRouter.
- Fallback models.
- moonshotai/kimi-k2, then google/gemini-2.5-flash.
- Dossier file.
- volta_dox.zip.
- Attribution.
- None given by Talos.
A Builder Sold to Customers, Not One Operator’s Tool
Talos describes VOLTA as a commercial product rather than a single group’s custom tool. “The author sells access, the customer provides their values, and the builder compiles a custom binary for each order,” the report says. Each order fills six configuration slots at compile time, so two VOLTA samples bought by different customers can behave differently.
The sample Talos analyzed carries the SHA256 hash 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, built as a PE32+ Windows binary with a compile timestamp of 17 August 2026, 20:35 UTC. Talos first observed it on 11 October 2026, at 12:46 UTC, under the file names 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe. VOLTA deletes itself from the infected machine once it finishes running.
What VOLTA Pulls From an Infected Windows Machine
Talos’s report lists a wide collection scope. VOLTA takes browser-saved passwords and cookies, payment card data, and cryptocurrency wallet seed phrases. It also takes Discord, Telegram, Steam and Roblox session data, Microsoft OAuth tokens, SSH and cloud configuration files, and Wi-Fi passwords through Windows’s WlanGetProfileList function.
Beyond stored credentials, Talos says VOLTA collects screenshots, the victim’s geolocation, employer information, and metadata pulled from the victim’s own documents. The malware then goes a step further than most infostealers Talos has analyzed. Using sessions it already stole, VOLTA reads Gmail for purchase receipts from services such as Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal. It also looks up the resale value of a victim’s Roblox items through the third-party site Rolimons.com.
Inside the Call to OpenRouter: Claude Opus 4.6, Then Two Fallbacks
Before it contacts any AI service, Talos says VOLTA assembles everything it stole into one structured dossier, which it keeps locally as a file called Identity_Report.txt. It then sends that structured data as a JSON request to the OpenRouter endpoint https://openrouter.ai/api/v1/chat/completions, an API that can route a single request to many different AI vendors’ models.
Talos says VOLTA’s request asks the model to act as “a forensic intelligence analyst drafting a target assessment.” It also sets the model’s temperature to 0.2, a setting that favors consistent, less varied answers. The request names anthropic/claude-opus-4.6 as the first model to try. If VOLTA’s code detects refusal language such as “I can’t” or “I’m not able,” Talos says it fails over to moonshotai/kimi-k2, then to google/gemini-2.5-flash if that also refuses.
- Browser logins, cards, crypto seeds and sessions harvestedVictim Hostcollected
- Haul structured into Identity_Report.txt and a JSON requestVictim Hostpackaged
- Request POSTed to openrouter.ai/api/v1/chat/completionsNetworksent
- Claude Opus 4.6 asked to act as a forensic analyst, temperature 0.2Cloud APIassessed
- On a detected refusal, retries Kimi K2, then Gemini 2.5 FlashCloud APIfailed over
- Model returns the worth and OPSEC assessmentCloud APIranked
- Result saved as AI_Analysis.txt and zippedVictim Hostcompiled
- Dossier sent to the operator as volta_dox.zipAttacker
What the Model Is Asked to Write
Talos says VOLTA’s prompt asks the model for two sections. The first, labeled “WHAT THEY’RE WORTH,” lists the victim’s valuables ranked by how easily they convert to money, each tagged low, medium or high. The second, labeled “THEIR OPSEC,” is the model’s assessment of the victim’s security habits and password hygiene.
Talos frames this as a resale feature rather than something built for one operator’s own use. The report says the capability “isn’t something the author invented for their own operations.” Instead, it is “a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments,” the report adds. A buyer with no analysis skill of their own gets a finished write-up.
The Dossier Leaves as volta_dox.zip, With No Actor Named
Talos describes VOLTA’s exfiltration in stages. The malware first sends a file named volta_log.zip once the initial collection finishes. It sends volta_dox.zip once the AI-written assessment is ready, and in some cases a third file, volta_doxnet.zip, when enrichment from the victim’s own accounts produces results.
Talos’s report does not attribute VOLTA to a named threat actor, criminal group or country. The write-up focuses on how the malware works and on the commercial model behind it, not on who is running it.
Why Talos Is Flagging the AI Call Itself
Talos’s CAIRN project tracks this kind of malware by scanning metadata already submitted to VirusTotal, not by downloading or running samples itself. The project describes looking for “cognitive artifacts,” meaning things like hardcoded prompts and LLM API calls left behind in a file’s scan data. VOLTA’s prompt text and its calls to the OpenRouter endpoint are the kind of artifact the project is built to find.
Talos’s report is explicit that the model VOLTA’s default configuration calls first is Anthropic’s Claude Opus 4.6, reached through the OpenRouter API rather than a direct Anthropic account. The malware’s own code, not Talos, picks that model and the two fallbacks. Nothing in the report describes Anthropic, Moonshot AI or Google as aware of or party to how their models are used here.
What stands out in Talos’s account is the fallback design itself. Because VOLTA checks each response for refusal language and moves to the next model on the list, a single vendor’s safety response does not stop the request. Whoever built VOLTA designed it to keep trying another provider’s model until one of the three produces the ranked write-up.
What Defenders Should Watch For
Talos’s indicators for this sample are the SHA256 hash 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 and the file names 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe. We recommend treating an outbound connection to openrouter.ai from a process that is not a known AI client as worth investigating. Few legitimate endpoint applications call that domain directly.
Because VOLTA’s collection touches browser-stored passwords, cookies, crypto wallets and Microsoft OAuth tokens, a confirmed infection calls for more than a password reset. Our infostealer glossary entry covers what this class of malware takes and why a reset alone does not clean an infected device.
Stolen sessions and cookies end up in the same kind of stealer log that criminals trade in bulk. Checking whether a company’s own accounts already appear in one is a reasonable next step, and our comparison of free options to check for infostealer logs walks through how. Ongoing visibility into leaked credentials across a workforce is the job of leaked credential monitoring, not a one-time check.