VOLTA: the infostealer that asks an AI model what each victim is worth

Based on Cisco Talos's report of October 31, 2026. Technical details are Talos's own.

Infostealers have always had a sorting problem. They take everything from an infected machine, and somebody then has to work out which of the thousands of logs is worth acting on. VOLTA, a Windows infostealer described by Cisco Talos, hands that job to an AI model. After it has taken the passwords, cookies and sessions, it builds a profile of the person behind the machine and asks a language model to rank what they are worth.

The AI part is the headline, but for anyone who shares credentials at work, the more useful part of the report is the list of what VOLTA takes in the first place.

What does VOLTA steal?

According to Talos, a single run collects saved passwords, cookies and payment cards from Chromium-based browsers, along with Firefox and Thunderbird data, Outlook profiles, Slack workspaces, Microsoft OAuth tokens, SSH and cloud-provider keys and configuration files, cryptocurrency wallet seed phrases, gaming and messaging sessions, every saved Wi-Fi password in plain text, and screenshots. The malware deletes itself after running, and Talos found no infrastructure owned by the attacker: the stolen data leaves through third-party services.

Then it uses what it took. With the victim's own Gmail tokens, VOLTA searches the inbox for receipts from retailers and delivery services to confirm a home address. Everything is assembled into a structured bundle: location, employer, inferred age, accounts, assets.

Where does the AI come in?

The bundle is sent, through the victim's own internet connection, to OpenRouter, a service that gives access to many AI models. A system prompt asks the model to act as a forensic intelligence analyst and produce a target assessment, including a section ranking the victim's valuables by how easily they can be turned into money, and another assessing their security habits and password hygiene. The configuration names a Claude model by default. If the model refuses, VOLTA checks the reply for phrases such as "I can't" and falls back to Kimi and then Gemini, which Talos reads as a sign that the author expected to hit refusals and engineered around them. Without an API key, the stealer simply runs without the AI stage.

Talos also found that VOLTA is built from a template with swappable settings, which suggests it is sold as a builder: each customer supplies their own values and receives a custom binary, then receives ranked victim profiles in their messaging inbox. As Talos puts it, the novelty is not a new way to steal but replacing the most labour-intensive human step, the triage, with a model call.

Why does this matter for teams that share credentials?

Because the haul is exactly where credentials end up when they are shared carelessly. A password pasted into Slack is readable to anyone holding a stolen Slack session. A key in a plain-text file on a developer's laptop, whether an SSH key, a cloud CLI profile or a .env file, is one of the first things a stealer collects. An OAuth token for Microsoft 365 or a Gmail session lets the attacker read the mailbox where last month's password was emailed. Infostealer logs are also where many stolen tokens begin their second life: in the Gheist campaign, Wiz traced the stolen GitHub tokens partly to infostealer logs.

What VOLTA adds is attention. A stealer that ranks its victims makes sure the valuable logs, the ones from an administrator's laptop or a finance team's browser, get acted on quickly rather than sitting in a pile.

What should you do?

Talos's own countermeasures are specific. Much of VOLTA's token theft relies on bypassing Chrome's App-Bound Encryption by launching the browser in headless mode, so an application control policy that restricts which processes may start Chrome with --headless blocks that path, and at minimum you can alert when it happens outside known developer tooling. Storing credentials in hardware-backed stores helps. If a machine is compromised, Talos advises preserving the stealer's own harvest log, which records exactly what was taken, then revoking every token that may have been exposed and changing passwords. A wallet whose seed phrase sat on disk in plain text should be treated as lost.

The broader habits that limit an infostealer's haul are the same ones this blog keeps returning to. Keep secrets out of plain-text files where you can, and out of chat and email altogether. Prefer short-lived credentials, so that what is stolen expires. Revoke sessions, not just passwords, after a compromise. And when you do need to hand a credential to someone, send it in a link that expires after it has been opened, so that a stolen chat history holds a dead link rather than a live password. Our guides on sending a password securely and sharing .env files with your team cover how.

---

Sources (checked on November 3, 2026):
Cisco Talos: Appraisal by AI, model-driven victim prioritization in the VOLTA infostealer (October 31, 2026)

Product names are trademarks of their respective owners. CredenShare is not affiliated with them.