Windows Stealer VOLTA Sends Stolen Data to Claude for Target Ranking

A self-deleting Windows infostealer calling itself VOLTA-AUTODOXER steals everything it can from a victim's PC, then feeds the haul to Anthropic's Claude to produce a ranked target assessment of the person's assets, Cisco's Talos research organization reports. The malware asks the model to list the victim's valuables by how much they could be cashed out for, so its operator knows what's worth the effort. If Claude refuses, it switches models. If no AI is available, it skips the step entirely.

The design is blunt. Stolen Gmail receipts and food-delivery orders feed an AI request for a "target assessment" of each victim, with the model instructed to act as "a forensic intelligence analyst" and to be "blunt, specific, accurate."

What does the malware steal?

The theft list is, on its own, fairly standard stealer fare — but the enrichment pass turns passive data into something dangerous. VOLTA grabs:

• Browser passwords, cookies and saved payment cards
• Thunderbird and Outlook email profiles
• Roblox accounts and Microsoft OAuth tokens
• Screenshots, SSH keys and cloud-provider configuration files
• Every saved Wi-Fi password, pulled in plaintext
• Cryptocurrency wallets — copied and then cracked inline

From that haul it builds a structured "evidence bundle" on the person: geolocation and home address, employer and employer domain, inferred birth year, document authorship metadata, and the last four digits of payment cards.

VOLTA doesn't stop at files. It engages in live enrichment using stolen sessions, searching the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address. It pulls Uber Eats and DoorDash order histories, reuses a stolen Discord token to fill in the victim's profile, and values Roblox items through Rolimons.

How does the AI stage work?

The data is assembled locally as Identity_Report.txt and serialized to JSON, then POSTed to OpenRouter, a popular model router, along with the system prompt. Any reply is saved as AI_Analysis.txt, and both files are exfiltrated together in a volta_dox.zip archive. The inference call runs over the victim's own network connection.

The model call asks for a concise assessment of the victim's suitability as a target, backed by citations, with an "opsec" analysis of overall security posture including password hygiene.

The settings reveal the operator's priorities. VOLTA uses Anthropic's Claude Opus 4.6 by default — an older model released in February — at a temperature of 0.2. Temperature controls how random a model's output is from a baseline of 1.0, and the hardcoded low value suggests the operator prizes predictability.

The author clearly anticipates refusals. VOLTA looks for refusal phrases and thin replies, then switches to two other models in order: Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash. If the VOLTA user supplies no API key for OpenRouter, the malware can still send the dossier over Telegram without the AI data.

Is this a product for resale?

Talos's findings suggest it is. VOLTA ships with a template containing six swappable slots — for a custom Telegram channel, API keys and settings — filled at build time. The customer supplies the values, and a custom binary gets created. The slot credentials are encrypted, but Talos notes they can be recovered from the file.

If everything goes to plan, the customer receives ranked target assessments in their Telegram inbox without relying on any attacker-owned infrastructure. The chokepoints sit on the services, not on the operator.

Can you defend against it?

Much of the token theft relies on bypassing Chrome's App-Bound Encryption, which VOLTA does by launching Chrome headless — without a GUI. An application-control policy that limits which processes may launch Chrome headless blocks that decryption path, cutting off access to Chrome-stored sessions. It doesn't stop the malware's other theft, the AI stage, or exfiltration.

After infection, the main executable may delete itself, but victims should preserve volta_debug.txt — a log showing what was collected and whether the LLM call succeeded. Talos advises targets to revoke or rotate all API keys and tokens and change passwords regardless of exposure. Any funds in a wallet whose seed phrase was stored in plaintext should be moved to a new wallet with a fresh seed, preferably generated on an air-gapped device.

What comes next?

One very real concern is that VOLTA's use of AI is narrow compared with what fully AI-assisted malware could do, especially if models handle additional phases. Refusal resilience may become a standard design requirement as AI integration in malware matures. A Windows implant reported in September was already built around a panel of up to four LLMs that vote on its next move, and another reported this week can fall back to using the victim's own OpenAI API key. For now, AI is replacing the work a human analyst would normally do — and the open question is which stage of the attack gets automated next.