{"id":"CMP-202610-volta-infostealer-for-windows-steals-passwords-sessions-clou","kind":"campaign","aliases":[],"related":[],"title":"VOLTA infostealer for Windows steals passwords, sessions, cloud/SSH keys and crypto wallets, then uses LLMs via OpenRouter to rank each victim's most valuable assets (Talos)","description":null,"summary":"Cisco Talos (31 Oct 2026) describes VOLTA (self-named VOLTA-AUTODOXER), a Windows infostealer that deletes itself after running and appears to be sold through a builder: each buyer gets a custom binary. It steals Chromium browser passwords, cookies and cards (it bypasses Chrome App-Bound Encryption by launching Chrome with --headless), as well as Firefox/Thunderbird and Outlook data, Slack workspaces, Discord, Telegram, Steam, Battle.net and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider config (gcloud, OpenVPN), saved Wi-Fi passwords and crypto wallets. It cracks wallet vaults on the machine. It then uses the stolen sessions to profile the victim further, for example by searching Gmail for receipts to confirm a home address and pulling UberEats/DoorDash order history. It sends the resulting dossier to OpenRouter (default model anthropic/claude-opus-4.6, falling back to kimi-k2 and then gemini-2.5-flash if a model refuses) to rank what the victim is worth. Stolen data goes to the operator over Telegram. All endpoints belong to third parties; there is no attacker-owned infrastructure. Sample first seen 2026-10-11. How it is spread and how many victims there are: unknown. At risk: Windows users and developers whose browsers and machines hold corporate SSO/OAuth sessions, Slack sessions, SSH keys or cloud credentials.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows","fixed":[],"ecosystem":"os"},{"name":"Google Chrome","fixed":[],"ecosystem":"browser"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look on Windows endpoints for %APPDATA%\\volta_debug.txt (VOLTA's harvest log), the files Identity_Report.txt or AI_Analysis.txt, or the archives volta_log.zip, volta_dox.zip and volta_doxnet.zip. Also look for the SHA256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 (filenames 9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe). Other signs: Chrome launched with --headless by a process that is not a known developer tool, and endpoints that are not developer machines making POST requests to openrouter.ai/api/v1/chat/completions or api.telegram.org.","fix":"Alert on or block Chrome being launched with --headless by unexpected processes; Talos says this cuts off VOLTA's cookie/token decryption path. On a hit, keep volta_debug.txt (it lists exactly what was taken), isolate the machine, and revoke all sessions and tokens on it (Microsoft 365/Entra OAuth, Google, Slack, Discord, Telegram). Rotate passwords, SSH keys and cloud credentials (gcloud and others). Treat crypto wallets whose seed was on disk as fully compromised and move the funds to a new seed. Keep credentials in hardware-backed stores.","status":"open","published_at":null,"first_seen_at":"2026-10-31T12:44:10+00:00","triaged_at":"2026-10-31T12:44:10+00:00","updated_at":"2026-10-31T12:44:10+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':231B '-11':232B '-2.5':193B '-202610':28A '2026':53B,230B '31':51B 'address':168B 'anthropic/claude-opus-4.6':183B 'app':96B 'app-bound':95B 'appear':71B 'asset':25A 'attack':224B 'attacker-own':223B 'autodox':61B 'autodoxer':41A 'back':185B 'battle.net':116B 'belong':216B 'binari':83B 'bound':97B 'browser':87B,251B 'builder':77B 'buyer':79B 'bypass':93B 'campaign':45B 'card':91B 'chrome':44A,94B,101B 'chromium':86B 'cisco':49B 'clou':37A 'cloud':126B,263B 'cloud-provid':125B 'cloud/ssh':8A 'cmp':27A 'config':128B 'confirm':165B 'cooki':89B 'corpor':255B 'crack':140B 'credenti':264B 'crypto':11A,137B 'custom':82B 'data':110B,207B 'default':181B 'delet':66B 'describ':54B 'develop':249B 'discord':113B 'dossier':178B 'earli':47B 'early-warn':46B 'encrypt':98B 'endpoint':215B 'exampl':158B 'fall':184B 'fi':134B 'firefox/thunderbird':107B 'first':228B 'flash':194B 'for':32A 'gcloud':129B 'gemini':192B 'get':80B 'gmail':161B 'goe':208B 'google':43A 'headless':103B 'histori':173B 'hold':254B 'home':167B 'infosteal':2A,64B 'infostealer':31A 'infrastructur':226B 'k2':189B 'key':9A,261B 'kimi':188B 'kimi-k2':187B 'launch':100B 'llms':15A 'machin':145B,253B 'mani':239B 'microsoft':120B 'model':182B,197B 'name':58B 'oauth':121B 'oct':52B 'openrout':17A,180B 'openvpn':130B 'oper':211B 'order':172B 'outlook':109B 'own':225B 'parti':219B 'password':6A,88B,135B 'passwords':35A 'profil':153B 'provid':127B 'pull':170B 'rank':19A,200B 'receipt':163B 'refus':198B 'result':177B 'risk':245B 'roblox':118B 'run':69B 'sampl':227B 'save':131B 'search':160B 'seen':229B 'self':57B 'self-nam':56B 'send':175B 'session':7A,119B,151B,257B,259B 'sessions':36A 'slack':111B,258B 'sold':74B 'spread':236B 'ssh':123B,260B 'sso/oauth':256B 'steal':5A,85B 'steals':34A 'steam':115B 'stolen':150B,206B 'talo':26A,50B 'telegram':114B,213B 'third':218B 'token':122B 'ubereats/doordash':171B 'unknown':243B 'use':14A,148B 'user':247B 'valuabl':24A 'vault':142B 'via':16A 'victim':21A,155B,203B,240B 'volta':1A,30A,38A,40A,55B,60B 'volta-autodox':59B 'volta-autodoxer':39A 'volta-infostealer-for-windows-steals-passwords-sessions-clou':29A 'wallet':12A,138B,141B 'warn':48B 'well':105B 'whose':250B 'wi':133B 'wi-fi':132B 'window':4A,63B,246B 'windows':33A,42A 'workspac':112B 'worth':205B","nicknames":["VOLTA","VOLTA-AUTODOXER"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-31T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-volta-infostealer-for-windows-steals-passwords-sessions-clou","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-31T12:44:10+00:00","fetched_at":"2026-10-31T12:44:10+00:00","note":null}],"documents":[{"id":32095,"url":"https://x.com/TalosSecurity/status/2116504206932582445","title":"@TalosSecurity: Sorting through mountains of stolen credentials is a major headache for attacker","kind":"post","source":"x","publisher":null,"text":"Sorting through mountains of stolen credentials is a major headache for attackers, so why not outsource the grunt work to AI? Talos' latest research on the VOLTA infostealer shows how it uses LLMs to profile victims and rank their most valuable assets: https://t.co/M6fL7BluTD https://t.co/h1cmTv2GdK\n\nlikes 3 reposts 0","published_at":"2026-10-31T12:15:00+00:00","relation":"describes","confidence":null,"note":null},{"id":32295,"url":"https://blog.talosintelligence.com/","title":"Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer (Cisco Talos)","kind":"blog","source":"analyst","publisher":null,"text":"Talos (Ryan Fetterman): VOLTA-AUTODOXER, self-deleting Windows infostealer sold via builder model; steals browser creds/cookies/cards (Chrome ABE bypass via --headless), crypto wallets with inline vault cracker, Discord/Telegram/Steam/Roblox/Slack sessions, Microsoft OAuth tokens, SSH and cloud config (gcloud), Wi-Fi passwords; enriches via victim Gmail receipts, UberEats/DoorDash; sends Identity_Report.txt to openrouter.ai/api/v1/chat/completions (claude-opus-4.6, fallback kimi-k2, gemini-2.5-flash) for target assessment; exfil to Telegram as volta_log.zip, volta_dox.zip, volta_doxnet.zip; log %APPDATA%\\volta_debug.txt. SHA256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, filenames 9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe, first seen 2026-10-11.","published_at":"2026-10-31T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}