VOLTA infostealer for Windows steals passwords, sessions, cloud/SSH keys and crypto wallets, then uses LLMs via OpenRouter to rank each victim's most valuable assets (Talos)

Cisco Talos (31 Oct 2026) describes VOLTA (self-named VOLTA-AUTODOXER), a Windows infostealer that deletes itself after running and appears to be sold through a builder: each buyer gets a custom binary. It steals Chromium browser passwords, cookies and cards (it bypasses Chrome App-Bound Encryption by launching Chrome with --headless), as well as Firefox/Thunderbird and Outlook data, Slack workspaces, Discord, Telegram, Steam, Battle.net and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider config (gcloud, OpenVPN), saved Wi-Fi passwords and crypto wallets. It cracks wallet vaults on the machine. It then uses the stolen sessions to profile the victim further, for example by searching Gmail for receipts to confirm a home address and pulling UberEats/DoorDash order history. It sends the resulting dossier to OpenRouter (default model anthropic/claude-opus-4.6, falling back to kimi-k2 and then gemini-2.5-flash if a model refuses) to rank what the victim is worth. Stolen data goes to the operator over Telegram. All endpoints belong to third parties; there is no attacker-owned infrastructure. Sample first seen 2026-10-11. How it is spread and how many victims there are: unknown. At risk: Windows users and developers whose browsers and machines hold corporate SSO/OAuth sessions, Slack sessions, SSH keys or cloud credentials.

Summary written from the sources below. Check the originals before acting.