VOLTA-AUTODOXER uses an LLM to rank victims’ assets

VOLTA builds a dossier before sending results to Telegram

The malware builds an evidence bundle containing geolocation and home address, employer and employer domain, inferred birth year, card last-four digits, Slack workspaces, document authorship metadata, iPhone backup indicators and a live Roblox account valuation.

Cisco Talos researcher Ryan Fetterman said VOLTA builds a structured evidence bundle about the person behind the machine. The bundle is serialized and sent to OpenRouter under a prompt directing the model to act as “a forensic intelligence analyst drafting a target assessment.”

The requested output includes a section titled “WHAT THEY'RE WORTH,” which ranks valuables by monetization using low, medium and high tiers, and a section assessing the victim’s security posture and password hygiene.

VOLTA switches models when a request is refused

VOLTA checks model responses for refusal phrases before passing the request through a chain of up to three models. Cisco Talos said requests default to Anthropic’s Claude Opus 4.6 and fall back to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash.

The model temperature is set to 0.2, which Talos said suggests an emphasis on accuracy and consistency. Talos described the AI layer as effort displacement rather than an improvement in speed or scale.

The resulting capability could let customers receive ranked target assessments in their Telegram inbox. Talos said VOLTA sends data over Telegram after execution, after the AI call and after live enrichment.

VOLTA uses live account data to enrich its target assessment

Cisco Talos said the first Telegram transfer contains browser passwords, cookies, payment cards, cryptocurrency wallets, Discord, Steam and Roblox tokens, Wi-Fi passwords and screenshots. The second contains captured data and the LLM analysis results.

The third transfer contains Gmail receipts and order histories from the live-enrichment step. Talos said VOLTA searches for receipts linked to Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to corroborate a home address.

The observed samples used the filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe. VOLTA uses a template with six swappable slots filled in at build time, a design Talos said suggests a builder model in which customers provide values and receive custom binaries.

Cisco Talos advises organizations to restrict which processes can launch Chrome with --headless, saying that policy would block VOLTA’s App-Bound Encryption decryption path.

Talos said the malware has no attacker-owned infrastructure among the observed endpoints. The inference round-trip takes place through the victim’s own network connection and machine before the result is exfiltrated.