Talos researcher Ryan Fetterman published the analysis on Oct 31. VOLTA is a mature stealer with an AI step bolted on after collection.

• Collection: Chromium, Firefox and Thunderbird credentials, cookies and cards; Outlook, Slack, Steam, Battle.net, Discord, Telegram and Roblox sessions; SSH and cloud configs; every saved Wi-Fi password via WlanGetProfileList; crypto wallets, with an embedded cracker run against wallet vaults.
• Enrichment with stolen sessions: searches the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls food-delivery order history, and prices Roblox inventory.
• LLM step: builds Identity_Report.txt, POSTs it to openrouter.ai/api/v1/chat/completions at temperature 0.2 with a prompt casting the model as a "forensic intelligence analyst" writing a target assessment, including "WHAT THEY'RE WORTH" and "THEIR OPSEC" sections. Default model anthropic/claude-opus-4.6; if the reply contains phrases like "I can't", it falls back to moonshotai/kimi-k2, then google/gemini-2.5-flash. It runs without the LLM step if no key is set.
• Exfiltration: up to three Telegram uploads (volta_log.zip, volta_dox.zip, volta_doxnet.zip). Six build-time slots for channel, keys and settings suggest a builder sold to customers; all observed endpoints are third-party services.

Detection and response: much of the cookie theft depends on bypassing Chrome's App-Bound Encryption by launching Chrome with --headless, so block or alert on headless Chrome started by anything other than known developer tools, and watch for workstation traffic to openrouter.ai from non-approved processes. If infected, keep %APPDATA%\volta_debug.txt (a timestamped harvest log), revoke tokens, change passwords, and move crypto to a freshly generated wallet. Sample SHA-256: 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 (first seen Oct 11).