EN PT-BR
← Voltar ao feed
medium

VOLTA-AUTODOXER infostealer uses LLMs via OpenRouter to profile victims and rank their monetizable assets

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 15:34 · coletado há 51 minutos

Cisco Talos analyzed VOLTA (self-named VOLTA-AUTODOXER), a self-deleting Windows infostealer that surfaced through the CAIRN research effort. After the usual data theft, it sends a structured evidence bundle about the victim to an LLM through OpenRouter. The model, prompted to act as a forensic intelligence analyst, returns a ranked dossier with sections titled "WHAT THEY'RE WORTH" and "THEIR OPSEC". Exfiltration goes through a Telegram channel. Talos assesses that the AI layer displaces analyst effort rather than adding speed or scale, and that the malware may be offered with a builder service.

Detalhes técnicos

  • Theft scope: browser passwords, cookies and payment cards from Chromium browsers, plus Firefox, Thunderbird and Outlook data. It also takes Slack workspace data, Discord, Telegram, Steam, Battle.net and Roblox sessions, Microsoft OAuth tokens, SSH keys, cloud credentials, screenshots and Wi-Fi passwords. It tries to crack crypto wallet passwords locally. It bypasses Chrome App-Bound Encryption, which Talos ties to Chrome launched with --headless.
  • Profiling: it builds a profile of the victim covering location and home address, employer, estimated birth year, last four card digits and iPhone backup signs, and checks Roblox account value. It uses the victim's logged-in sessions to search Gmail for receipts (Amazon, DoorDash, Uber Eats, Grubhub, Walmart, PayPal) and to pull order histories.
  • LLM stage: requests are hand-built JSON with temperature 0.2. The default model is Anthropic Claude Opus 4.6. If it refuses (detected by phrases such as "I can't"), VOLTA falls back to Moonshot AI Kimi K2 and then Google Gemini 2.5 Flash. Without an API key the stealer still runs. The analysis runs on the victim host over the victim's own connection, with no attacker-controlled server.
  • Artifacts: Identity_Report.txt, AI_Analysis.txt, volta_log.zip, volta_dox.zip, and volta_doxnet.zip (when extra network data is found). %APPDATA%\volta_debug.txt is a timestamped log of collection and AI call results.
  • Builder: six configurable fields are encrypted with a weak scheme whose key is embedded in the binary, so credentials can be recovered by analysis.

Remediação

  • Use application control to restrict which processes can launch Chrome with --headless, or at minimum alert on it outside a known developer set.
  • Store credentials in hardware-backed stores.
  • If compromised, preserve %APPDATA%\volta_debug.txt, revoke exposed tokens and change passwords.
  • Treat any wallet whose seed phrase sat in plaintext as fully compromised and move funds to a new wallet with a seed generated on an air-gapped device.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 02/11/2026 15:34 · coletado 02/11 17:00 primeiro registro

    VOLTA-AUTODOXER infostealer uses LLMs via OpenRouter to profile victims and rank their monetizable assets

    ler a análise desta fonte

    Cisco Talos analyzed VOLTA (self-named VOLTA-AUTODOXER), a self-deleting Windows infostealer that surfaced through the CAIRN research effort. After the usual data theft, it sends a structured evidence bundle about the victim to an LLM through OpenRouter. The model, prompted to act as a forensic intelligence analyst, returns a ranked dossier with sections titled "WHAT THEY'RE WORTH" and "THEIR OPSEC". Exfiltration goes through a Telegram channel. Talos assesses that the AI layer displaces analyst effort rather than adding speed or scale, and that the malware may be offered with a builder service.

    Technical Details

    • Theft scope: browser passwords, cookies and payment cards from Chromium browsers, plus Firefox, Thunderbird and Outlook data. It also takes Slack workspace data, Discord, Telegram, Steam, Battle.net and Roblox sessions, Microsoft OAuth tokens, SSH keys, cloud credentials, screenshots and Wi-Fi passwords. It tries to crack crypto wallet passwords locally. It bypasses Chrome App-Bound Encryption, which Talos ties to Chrome launched with --headless.
    • Profiling: it builds a profile of the victim covering location and home address, employer, estimated birth year, last four card digits and iPhone backup signs, and checks Roblox account value. It uses the victim's logged-in sessions to search Gmail for receipts (Amazon, DoorDash, Uber Eats, Grubhub, Walmart, PayPal) and to pull order histories.
    • LLM stage: requests are hand-built JSON with temperature 0.2. The default model is Anthropic Claude Opus 4.6. If it refuses (detected by phrases such as "I can't"), VOLTA falls back to Moonshot AI Kimi K2 and then Google Gemini 2.5 Flash. Without an API key the stealer still runs. The analysis runs on the victim host over the victim's own connection, with no attacker-controlled server.
    • Artifacts: Identity_Report.txt, AI_Analysis.txt, volta_log.zip, volta_dox.zip, and volta_doxnet.zip (when extra network data is found). %APPDATA%\volta_debug.txt is a timestamped log of collection and AI call results.
    • Builder: six configurable fields are encrypted with a weak scheme whose key is embedded in the binary, so credentials can be recovered by analysis.

    Remediation

    • Use application control to restrict which processes can launch Chrome with --headless, or at minimum alert on it outside a known developer set.
    • Store credentials in hardware-backed stores.
    • If compromised, preserve %APPDATA%\volta_debug.txt, revoke exposed tokens and change passwords.
    • Treat any wallet whose seed phrase sat in plaintext as fully compromised and move funds to a new wallet with a seed generated on an air-gapped device.