Stealers have always been blunt instruments. They grab everything, dump it on a Telegram channel, and let whoever buys the logs sort out what matters.

VOLTA-AUTODOXER, which researchers at Cisco Talos are tracking as VOLTA, is the first one I have seen that does the sorting itself. It builds an evidence bundle about the victim, feeds it to a large language model, and gets back a ranked assessment of what the person behind that machine is worth.

Ryan Fetterman at Talos put it plainly. The malware builds a structured evidence bundle about the person behind the machine, and that bundle includes geolocation, home address, employer, inferred birth year, card last-four digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation.

That is not a credential dump. That is a background check.

What VOLTA Actually Steals

Start with the standard stealer menu, because VOLTA does all of it.

• Passwords and cookies from Chromium-based browsers
• Outlook profile data and Slack workspace data
• Payment cards
• Cryptocurrency wallet seed phrases
• Discord, Telegram, Steam, and Roblox sessions
• Microsoft OAuth tokens
• SSH keys and cloud-provider keys
• Wi-Fi profiles
• Screenshots

Now add the part that makes it different.

The Gmail Receipt Trick

To confirm the home address is real rather than guessed, VOLTA uses the victim's stolen session access to search their own Gmail.

It looks for receipts. Amazon, DoorDash, Uber Eats, Grubhub, Walmart, PayPal. Order confirmations, delivery notifications, anything that ties a name to a physical location.

That is a small detail with an outsized effect. A home address inferred from an IP geolocation is a guess. A home address corroborated by six months of Amazon deliveries is a fact.

Feeding the Bundle to an AI

Once the bundle is assembled, VOLTA serializes it and sends it to a system through OpenRouter, which is a unified API gateway that routes requests across multiple LLM providers.

The default model is Anthropic's Claude Opus 4.6. If that refuses, it falls back to Moonshot AI's Kimi K2, and then to Google's Gemini 2.5 Flash.

Talos noted the multi-model architecture is specifically designed to survive refusals. The malware checks each response for phrases like "I can't" or "I'm not able," then moves to the next model in a chain of up to three.

That is a deliberate engineering decision. The author expected refusals and built around them.

The 240-Word System Prompt

The prompt instructs the model to assume the role of a forensic intelligence analyst drafting a target assessment from a structured evidence bundle.

One line from the prompt is worth quoting, because it shows how carefully this was built. The bundle is the only permissible source of facts, and the model's training knowledge must never supply a fact about the subject.

So the model is not allowed to speculate. It has to work from the stolen evidence and cite it.

The required output has two sections. One is titled "WHAT THEY'RE WORTH," with valuables ranked by monetization and tiered low, medium, or high. The other is "THEIR OPSEC," which assesses the victim's security posture and password hygiene.

Talos described the model's role as operator triage. It turns a raw credential log into a prioritized, citation-backed dossier of the victim and their monetizable assets.

Three-Stage Exfiltration

Data leaves over Telegram, and it leaves three times.

Sending in stages is not laziness. It means the operator gets something valuable even if the AI call fails or the enrichment step gets interrupted.

The Builder Kit Question

VOLTA uses a template with six slots filled at build time. Telegram channel for exfiltration, API keys, and other settings.

That structure suggests one of two things. Either the author is advertising a builder kit to customers, or they are running a bespoke compilation service where each buyer gets a custom binary.

Talos leaned toward the commoditized reading. If VOLTA is a product, then the AI dossier capability is not a bespoke tool for a sophisticated operator. It is a feature that lets any buyer, at any skill level, point the malware at victims and start receiving ranked target assessments in their Telegram inbox.

That is the part worth sitting with. Effort displacement, not speed or scale, is what changed here.

NIK C2 and the LLMjacking Problem

Last week, Talos also published research on a framework called NIK C2, and the two stories belong together.

NIK C2 is a Go-based Windows remote access tool that grants persistent control and supports more than 52 commands from a command-and-control server. Remote access, credential theft, keylogging, defense evasion, surveillance, ransomware.

The notable part is the OpenAI integration. The implant checks whether the actor supplied an API key. If not, it scans the victim's environment variables for OPENAI_API_KEY and uses that one.

So the victim pays for the AI inference that is being run against them. That is LLMjacking, and the side benefit is attribution laundering, because the requests come from the victim's own account.

Talos called that fallback a deliberate design rather than a backup, and the operational implications are obvious. If your developers have an OpenAI key in their environment, that key is now an attack surface.

What Defenders Need to Do

• Hunt for OPENAI_API_KEY exposure. Environment variables on developer machines are now a funding source for attackers. Audit them, scope them, and rotate them.
• Watch outbound traffic to OpenRouter. Legitimate developer use exists, so baseline it first, then flag unusual patterns from endpoints that should not be making LLM calls at all.
• Monitor Telegram exfiltration. Three-stage sends mean multiple bursts. Egress monitoring on Telegram API endpoints is worth the effort.
• Check for Gmail session abuse. A browser session that searches for Amazon, DoorDash, and PayPal receipts in rapid succession is not a normal user pattern.
• Treat developer endpoints as crown jewels. VOLTA grabs SSH keys, cloud keys, and seed phrases. That machine is the perimeter now.
• Watch for model-refusal probing. Outbound calls to multiple LLM providers in sequence, from one host, within seconds, is a signature.

FAQ

What is VOLTA?

VOLTA-AUTODOXER is a Windows infostealer that collects credentials and then uses a large language model to rank the stolen data by how much it is worth to an attacker. Talos tracks it as VOLTA.

How does the AI part work?

The malware assembles an evidence bundle about the victim, sends it through OpenRouter to Claude Opus 4.6 by default, and falls back to Kimi K2 and Gemini 2.5 Flash if the model refuses. The output includes a section ranking valuables by monetization tier and a section assessing the victim's operational security.

Why does it search Gmail for receipts?

To corroborate the victim's home address. An IP-based geolocation is a guess. An Amazon or DoorDash delivery confirmation is evidence.

Is VOLTA being sold as a kit?

That is Talos's assessment, based on a six-slot template that gets filled at build time. If it is commoditized, then the AI triage feature is available to buyers at any skill level, not just elite operators.

What is LLMjacking in the NIK C2 context?

NIK C2 looks for the victim's own OPENAI_API_KEY environment variable if the attacker did not supply one. That means the victim's account pays for the AI inference, and the requests appear to come from the victim.

Source: The Hacker News