🔍 Read the full analysis: What Does The VOLTA Infostealer Ask Claude About Its Victims? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cisco Talos reported that a Windows infostealer called VOLTA-AUTODOXER sends information stolen from victims to an AI model through OpenRouter and asks for a target assessment, including an estimate of what the victim’s data and accounts may be worth. Talos identified Claude Opus 4.6 as the default model in the sample it analyzed, but did not confirm that Claude or another model generated an assessment or report how many people were affected.
Cisco Talos reported on Oct. 31 that a Windows infostealer called VOLTA-AUTODOXER sends profiles built from stolen data to an AI model and requests a target assessment. The sample Talos analyzed lists Anthropic’s Claude Opus 4.6 as its default model, an example of malware using AI to organize information about victims, though Talos did not confirm that a model returned a usable assessment.
In a report titled “Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer,” Talos researcher Ryan Fetterman described a sample first observed on Oct. 11, 2026. Talos said VOLTA collects browser passwords, cookies and saved payment cards, along with account sessions, Microsoft sign-in tokens, Wi-Fi passwords, screenshots, crypto wallets, and SSH and cloud configuration files.
The malware also uses some stolen account access to gather additional details, according to Talos. It searches Gmail for purchase receipts, checks food-delivery histories, and retrieves information from services including Discord and Roblox. It combines the resulting material into a profile that may include a home address, employer, inferred birth year, payment-card details and workspaces.
VOLTA saves the profile, structures the data and sends it through OpenRouter, a service that provides access to multiple AI models. Talos said the prompt asks the model to act as a forensic intelligence analyst and produce a “target assessment.” A requested section titled “WHAT THEY’RE WORTH” asks for an appraisal of valuables and their potential cash-out value; the prompt also asks about the victim’s security habits and connections among personal details and password patterns.
The sample’s settings name Claude Opus 4.6 as the default, with Moonshot’s Kimi K2 and Google’s Gemini 2.5 Flash listed as alternatives if the preferred model refuses, according to the source material’s account of the Talos report. If the malware has no API key, it skips the AI step and still sends stolen material to its operator through Telegram. The source material says Talos analyzed one sample and did not provide a victim count.
Infographic 01 · How VOLTA works
A stealer that hands the sorting to an AI
What Cisco Talos describes, step by step, at the level defenders need. First seen 11 Oct 2026; Talos believes it is sold as a kit.
- StealPasswords, cookies, cards, chat and gaming sessions, sign-in tokens, SSH and cloud files, Wi-Fi passwords, wallets
- EnrichUses stolen sessions to confirm a home address and fill in the profile
- Ask a modelSends the profile to a model router for a “target assessment”
- Send outStolen data and any AI report go to the buyer over Telegram
- VanishThe main program may delete itself
- 1st choiceAnthropic Claude Opus 4.6
- If it refusesMoonshot Kimi K2
- If that refusesGoogle Gemini 2.5 Flash
- No API key?Skip the AI, send the raw data anyway
Required sections of the report: “WHAT THEY’RE WORTH” and “THEIR OPSEC”.
- Whether Claude, or any model, actually wrote a dossier.
- How many victims there are. Talos analysed one sample.
- How VOLTA reaches victims.
- Whether Anthropic or OpenRouter were notified.
Source: Cisco Talos, 31 Oct 2026. Simplified for readers; no hashes, prompts or attack details reproduced.
Powered by Thorsten Meyer AI
AI Helps Sort Stolen Victim Data
The report matters because it describes AI being used not to break into a device, but to process information after theft. Stolen data can be extensive, and reviewing accounts, work files and personal records takes time. A model-generated assessment, if the process works as intended, could help an operator decide which victims appear more valuable or easier to exploit.
Talos describes this as “effort displacement”: using a model to take over a tedious task previously handled by a person. That label describes the apparent purpose of the prompt; it does not establish that VOLTA’s AI step succeeded or improved criminal outcomes. The malware’s fallback path also shows that AI is an added processing option, not a requirement for the theft or transmission of data.
For organizations, the combination of broad credential theft and automated profiling underscores why endpoint controls and monitoring for unusual AI-service traffic may matter. For individuals, the reported collection of sessions, credentials and personal records means that a compromised computer can expose much more than a single password. The report does not establish the scale of activity or identify victims.
Products Worth Considering
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How VOLTA Builds Its Assessments
Talos said the sample came to its attention through CAIRN, a project that hunts for malware incorporating AI. The report describes familiar infostealer behavior—collecting credentials and account data—alongside added steps to expand a victim profile and pass it to a model. This is the specific development at issue; the report is not evidence that all infostealers use AI.
The prompt asks for a structured assessment, including a citation trail, an estimate of what can be monetized and comments on password hygiene. The source material says the model’s temperature setting is 0.2, a low value that the report interprets as favoring more consistent answers. That is a setting in the analyzed sample, not proof that its output was accurate or that an operator acted on it.
The source account also places the finding alongside Anthropic’s reported plan to extend invisible text watermarking to older Claude models, including Opus 4.6, starting Nov. 3. That watermark concerns generated text and is separate from Talos’s malware finding: it does not prevent a stolen profile from being sent to an AI service. The timing does not establish a link between the two developments.
““effort displacement””
— Cisco Talos
What Talos Could Not Confirm
Talos did not report whether Claude—or any other model—actually returned a dossier in response to VOLTA’s prompt. The report, as described in the source material, also gives no count of victims, no measure of how often the AI step is used and no evidence that operators relied on an assessment to choose targets.
The available account concerns one analyzed sample, first seen on Oct. 11. It does not establish how widely VOLTA is distributed or whether other versions use the same model settings. The source material says no public response from Anthropic or OpenRouter had been identified as of Nov. 2; that does not establish whether either company has taken action or received a report.
It is also not clear what information was sent to the model in any real operation, how the API key was obtained, or whether service providers could identify or block the activity. The reported watermarking change is not described as a safeguard against malware sending prompts or stolen data to a model.
Monitoring for Further Evidence
The next evidence needed is confirmation of whether VOLTA’s model calls succeed in real cases, alongside information about the malware’s distribution and any affected victims. Talos has not announced those details in the material provided. The report’s findings may also be followed by statements from the AI services involved, but none was included in the source account as of Nov. 2, 2026.
Talos’s defensive recommendations, as summarized in the source material, include restricting which programs can launch Chrome in headless mode and monitoring ordinary desktop systems for unusual AI API traffic. Businesses can also review short-lived sessions and revoke credentials quickly when compromise is suspected. Individuals should avoid keeping crypto seed phrases in text files, use a password manager and carry out account recovery from a clean device.
Those steps address exposure and response; they do not establish that a particular organization or person has been targeted. More reporting will depend on technical analysis of additional samples, service-provider information or confirmed incident reports.
Key Questions
What does VOLTA ask Claude to do?
According to Cisco Talos, VOLTA sends a profile assembled from stolen information to an AI model and asks it to draft a target assessment. The requested sections include an estimate of what the victim’s data or valuables could be worth and an appraisal of security habits.
Did Claude produce an assessment for the malware operators?
Talos did not confirm that. Its report describes the prompt and model settings in an analyzed sample, but the source material does not say whether Claude or another model returned a dossier.
What information does VOLTA reportedly steal?
Talos says the sample collects browser credentials and cookies, payment-card details, account sessions, Microsoft sign-in tokens, Wi-Fi passwords, screenshots, crypto wallets, and SSH and cloud configuration files. It also uses some account access to gather more personal and work-related details.
Does the malware stop if the AI service is unavailable?
Not according to the source material. If VOLTA has no API key, it skips the AI assessment and still sends the stolen data to its operator through Telegram.
What should someone do if a device may be infected?
Use a clean device to change exposed passwords, revoke active sessions and review accounts for unauthorized access. Avoid storing crypto seed phrases in plain-text files; organizations should also investigate suspected endpoint compromise and revoke affected credentials.
Source: ThorstenMeyerAI.com
