---
title: Talos: VOLTA infostealer sends each victim's stolen data to an LLM through OpenRouter to rank what they're worth, falling back from Claude Opus 4.6 to Kimi K2 and Gemini 2.5 Flash when a model refuses | ctxsec
url: https://ctxsec.com/items/talos-volta-autodoxer-infostealer-llm-victim-ranking
description: "Cisco Talos describes VOLTA-AUTODOXER, a self-deleting Windows stealer that, after taking passwords, cookies, cards, wallets and session tokens, uses stolen Gmail, Uber Eats and DoorDash sessions to confirm a victim's home address and then posts an 'evidence bundle' to OpenRouter with a prompt asking for a target assessment, including a 'WHAT THEY'RE WORTH' ranking. It checks replies for refusal phrases and moves down a three-model chain. Results go to the operator over Telegram. Talos thinks it is sold as a builder kit."
status: "official (Cisco Talos research, Oct 31)"
published: 2026-11-02
---

> Cisco Talos describes VOLTA-AUTODOXER, a self-deleting Windows stealer that, after taking passwords, cookies, cards, wallets and session tokens, uses stolen Gmail, Uber Eats and DoorDash sessions to confirm a victim's home address and then posts an 'evidence bundle' to OpenRouter with a prompt asking for a target assessment, including a 'WHAT THEY'RE WORTH' ranking. It checks replies for refusal phrases and moves down a three-model chain. Results go to the operator over Telegram. Talos thinks it is sold as a builder kit.

[← AI](/ai) · [markdown](/items/talos-volta-autodoxer-infostealer-llm-victim-ranking.md)

official (Cisco Talos research, Oct 31)

2026-11-02

### Talos: VOLTA infostealer sends each victim's stolen data to an LLM through OpenRouter to rank what they're worth, falling back from Claude Opus 4.6 to Kimi K2 and Gemini 2.5 Flash when a model refuses

Talos researcher Ryan Fetterman published the analysis on **Oct 31**. VOLTA is a mature stealer with an AI step bolted on after collection.

- **Collection:** Chromium, Firefox and Thunderbird credentials, cookies and cards; Outlook, Slack, Steam, Battle.net, Discord, Telegram and Roblox sessions; SSH and cloud configs; every saved Wi-Fi password via `WlanGetProfileList`; crypto wallets, with an embedded cracker run against wallet vaults.
- **Enrichment with stolen sessions:** searches the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls food-delivery order history, and prices Roblox inventory.
- **LLM step:** builds `Identity_Report.txt`, POSTs it to `openrouter.ai/api/v1/chat/completions` at temperature 0.2 with a prompt casting the model as a "forensic intelligence analyst" writing a target assessment, including "WHAT THEY'RE WORTH" and "THEIR OPSEC" sections. Default model `anthropic/claude-opus-4.6`; if the reply contains phrases like "I can't", it falls back to `moonshotai/kimi-k2`, then `google/gemini-2.5-flash`. It runs without the LLM step if no key is set.
- **Exfiltration:** up to three Telegram uploads (`volta_log.zip`, `volta_dox.zip`, `volta_doxnet.zip`). Six build-time slots for channel, keys and settings suggest a builder sold to customers; all observed endpoints are third-party services.

**Detection and response:** much of the cookie theft depends on bypassing Chrome's App-Bound Encryption by launching Chrome with `--headless`, so block or alert on headless Chrome started by anything other than known developer tools, and watch for workstation traffic to `openrouter.ai` from non-approved processes. If infected, keep `%APPDATA%\volta_debug.txt` (a timestamped harvest log), revoke tokens, change passwords, and move crypto to a freshly generated wallet. Sample SHA-256: `57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279` (first seen Oct 11).

Sources: [Cisco Talos: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer (Oct 31)](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) · [The Hacker News (Nov 2)](https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html)