SafetyPublished All news from that day
Ongoing case: Cyber-capable AI models 22 stories
Cisco Talos reports VOLTA infostealer sends an evidence bundle to Claude Opus 4.6 by default to rank assets
Cisco Talos describes a self-deleting stealer whose optional AI step drafts a target assessment of each victim and switches models if one refuses. Talos names no operator.
Check our sources · 10 facts from 1 sourceAn infostealer called VOLTA sends what it steals to a large language model that ranks the victim's assets by monetization value, Cisco Talos reports. The analysis, titled "Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer", was published on 31 October 2026.
Talos says the default model is anthropic/claude-opus-4.6, reached through OpenRouter's chat completions API. If a reply contains a refusal phrase such as "I can't" or "I'm not able", VOLTA moves on to moonshotai/kimi-k2 and then google/gemini-2.5-flash, and the AI stage is skipped entirely when no API key is present.
The system prompt tells the model to act as "a forensic intelligence analyst drafting a target assessment".
Talos lists the stolen data as browser passwords, cookies and saved payment cards, email profiles, Slack, Discord, Telegram, Steam, Roblox and Battle.net sessions, Microsoft OAuth tokens, SSH and cloud configuration files, screenshots and cryptocurrency wallets.
It says the results leave the machine as volta_log.zip, volta_dox.zip and, if enrichment produces results, volta_doxnet.zip. Talos calls the stealer self-deleting and lists 2026-10-11 as the first-seen date in its sample table.
It does not identify the operator, says all observed endpoints are third-party controlled, and suggests a builder model in which the author sells access and the customer provides their values.
For defenders, Talos advises restricting which processes can launch Chrome with --headless, storing credentials in hardware-backed stores, and, after a compromise, preserving the volta_debug.txt log, revoking exposed tokens and changing passwords.
Underlined sentences link to the facts we checked. Dotted words open a short explainer.
Fact 5 of 10 · from Cisco Talos, 31 Oct 2026
a forensic intelligence analyst drafting a target assessment.
Fact 9 of 10 · from Cisco Talos, 31 Oct 2026
All the observed endpoints for this malware are third-party controlled.
Fact 10 of 10 · from Cisco Talos, 31 Oct 2026
Revoke any potentially compromised tokens and change passwords.
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against this source.
1 Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
Open the source archived copy-
Cisco Talos describes VOLTA, also referred to as VOLTA-AUTODOXER, as a mature stealer implant with an optional AI-integration layer; it sends a structured evidence bundle to an LLM, which ranks the victim's assets by monetization value in a victim-profiling stage.
Toned down to what the source says
citeVOLTA is a mature stealer implant with an optional AI-integration layer.
-
The Talos post is titled Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer and is dated 31 October 2026.
citeAppraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
-
Talos says VOLTA calls OpenRouter's chat completions API, with anthropic/claude-opus-4.6 as the default model and a fallback chain of moonshotai/kimi-k2, then google/gemini-2.5-flash.
citemoonshotai/kimi-k2 → google/gemini-2.5-flash
-
Talos says VOLTA checks each response for refusal phrases such as I can't and I'm not able and moves to the next model in the chain when it finds one, and that the LLM stage can be skipped entirely if no API key is present.
citethe ability to run without the LLM stage altogether if no key is present
-
Talos says the system prompt instructs the model to act as a forensic intelligence analyst drafting a target assessment.
citea forensic intelligence analyst drafting a target assessment.
-
Talos lists the initial theft as browser passwords, cookies and saved payment cards from Chromium browsers; Firefox, Thunderbird and Outlook data; Slack, Steam, Battle.net, Discord, Telegram and Roblox sessions; Microsoft OAuth tokens; SSH and cloud configuration files; screenshots; and cryptocurrency wallets.
citeIt hits Firefox and Thunderbird, Outlook profiles, Slack workspaces, Steam and Battle.net sessions
-
Talos describes three staged uploads: volta_log.zip after theft, volta_dox.zip after the AI call, and volta_doxnet.zip if enrichment produces results.
citeVOLTA's exfil can happen in three stages: 1) after the stealer runs ("volta_log.zip"),
-
Talos calls the stealer self-deleting, and its sample table lists a first-seen date of 2026-10-11 12:46 UTC.
Toned down to what the source says
citeThis stealer is self-deleting, and there is no attacker-owned infrastructure.
-
Talos names no operator; it states that all observed endpoints for this malware are third-party controlled and that there is no attacker-owned infrastructure, and says this suggests a builder model in which the author sells access and the customer provides their values.
Toned down to what the source says
citeAll the observed endpoints for this malware are third-party controlled.
-
Talos recommends restricting which processes can launch Chrome with --headless, storing credentials in hardware-backed stores, and after compromise preserving volta_debug.txt, revoking potentially exposed tokens and changing passwords.
citeRevoke any potentially compromised tokens and change passwords.
Every sentence above is checked against this source. Each fact has its own address you can cite.
Source 1 · Cisco Talos · 31 Oct 2026
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
Cisco Talos describes VOLTA, also referred to as VOLTA-AUTODOXER, as a mature stealer implant with an optional AI-integration layer; it sends a structured evidence bundle to an LLM, which ranks the victim's assets by monetization value in a victim-profiling stage.
Toned down to what the source saysVOLTA is a mature stealer implant with an optional AI-integration layer.
The Talos post is titled Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer and is dated 31 October 2026.
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
Talos says VOLTA calls OpenRouter's chat completions API, with anthropic/claude-opus-4.6 as the default model and a fallback chain of moonshotai/kimi-k2, then google/gemini-2.5-flash.
moonshotai/kimi-k2 → google/gemini-2.5-flash
Show all 10 factsShow fewer facts
Talos says VOLTA checks each response for refusal phrases such as I can't and I'm not able and moves to the next model in the chain when it finds one, and that the LLM stage can be skipped entirely if no API key is present.
the ability to run without the LLM stage altogether if no key is present
Talos says the system prompt instructs the model to act as a forensic intelligence analyst drafting a target assessment.
a forensic intelligence analyst drafting a target assessment.
Talos lists the initial theft as browser passwords, cookies and saved payment cards from Chromium browsers; Firefox, Thunderbird and Outlook data; Slack, Steam, Battle.net, Discord, Telegram and Roblox sessions; Microsoft OAuth tokens; SSH and cloud configuration files; screenshots; and cryptocurrency wallets.
It hits Firefox and Thunderbird, Outlook profiles, Slack workspaces, Steam and Battle.net sessions
Talos describes three staged uploads: volta_log.zip after theft, volta_dox.zip after the AI call, and volta_doxnet.zip if enrichment produces results.
VOLTA's exfil can happen in three stages: 1) after the stealer runs ("volta_log.zip"),
Talos calls the stealer self-deleting, and its sample table lists a first-seen date of 2026-10-11 12:46 UTC.
Toned down to what the source saysThis stealer is self-deleting, and there is no attacker-owned infrastructure.
Talos names no operator; it states that all observed endpoints for this malware are third-party controlled and that there is no attacker-owned infrastructure, and says this suggests a builder model in which the author sells access and the customer provides their values.
Toned down to what the source saysAll the observed endpoints for this malware are third-party controlled.
Talos recommends restricting which processes can launch Chrome with --headless, storing credentials in hardware-backed stores, and after compromise preserving volta_debug.txt, revoking potentially exposed tokens and changing passwords.
Revoke any potentially compromised tokens and change passwords.
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep