Cisco Talos reported on October 31, 2026, that a Windows infostealer called VOLTA uses language models to rank a victim's assets by their potential value to criminals. Its technical analysis describes an optional stage after data theft: the malware assembles personal information and sends it to a model for a target assessment, reducing the sorting work left to its operator.
The report establishes a concrete use for AI inside the malware's workflow. It doesn't measure the accuracy of those assessments or how much money they help an attacker make. MrKeyoor has not executed the sample or independently tested its model calls.
From stolen sessions to a victim dossier
According to Talos's analysis, VOLTA collects browser passwords and cookies, cryptocurrency wallet material, and credentials including SSH and cloud-provider keys. It then uses stolen sessions to gather more context. Gmail receipts can help establish a home address, while delivery-service order histories and Discord account information add details about the person behind the device.
The malware assembles its findings locally in Identity_Report.txt and sends a structured bundle to OpenRouter, a service through which it requests model responses. The requested assessment includes a ranking of assets by monetization value and an appraisal of the victim's password habits. Talos says the returned analysis is saved as AI_Analysis.txt and sent out with the identity report in volta_dox.zip.
For defenders, this connects two kinds of exposure that can look separate during an investigation. A stolen session can expose account contents, and those contents can help an attacker interpret other stolen records. In the workflow Talos describes, an ordinary purchase receipt becomes evidence linking an online account to a physical address.
A refusal triggers another model request
Talos identifies Claude Opus 4.6 as the default model, followed by Kimi K2 and Gemini 2.5 Flash in a fallback chain. The malware checks responses for refusal phrases and tries another model when it encounters them. That is evidence of an attempt to work around refusals; the report doesn't supply a success rate across those services.
The AI stage is optional, and VOLTA can run without it when no API key is present. This matters for incident response: a failed model request doesn't establish that the passwords and sessions were safe. Collection happens earlier in the documented sequence.
The useful trace may survive the executable
Talos's countermeasures include preserving the volta_debug.txt harvest log if it remains after the main executable deletes itself. The researchers say that log records what was collected and whether the model call succeeded. They also advise revoking potentially compromised tokens and changing passwords.
The report lists the analyzed sample as first seen on October 11, separating that observation from the October 31 disclosure. Its configurable build slots suggest a builder sold to other operators, in Talos's assessment, but the researchers present that distribution model as an inference. Evidence of broader deployment and measured assessment accuracy would help establish how consequential the AI layer becomes. For an affected host, the immediate question remains what was collected before that layer ran.