VOLTA infostealer uses a commercial AI model to profile victims after stealing their sessions
- Severity
- High
- Sources
- 1
What happened
VOLTA is a Windows infostealer documented by Cisco Talos (published 31 October 2026) that steals browser secrets, Discord and Microsoft OAuth tokens, SSH keys and wallet vaults, and reportedly works around Chrome App-Bound Encryption. It sends an IdentityReport.txt to OpenRouter (default anthropic/claude-opus-4.6, fallbacks moonshotai/kimi-k2 and google/gemini-2.5-flash, temperature 0.2) and saves the output as AIAnalysis.txt, packaged in voltadox.zip. Talos suggests blocking Chrome launches with --headless unless a known developer process starts them, monitoring for outbound calls to openrouter.ai, and treating the voltadebug.txt log as a record of what was taken. Revoke tokens and reset passwords from a clean device, and move crypto funds if seed phrases were stored in plain text. No CVEs were named.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Block Chrome from starting with the --headless flag unless a known developer process launches it.
- Check endpoints for the %APPDATA%\voltadebug.txt log and review outbound connections to the OpenRouter AI endpoint.
- If infection is suspected, revoke tokens and reset passwords from a clean device.
- Move crypto funds to a new wallet if the seed phrase was stored in plain text.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Malware
Companies