enzosoler.comreviews 08bench 9 devices
Enzo Soler Desk tech, tested
Subscribe
Published

VOLTA malware asks an AI model what each victim is worth. Your browser cookies are what it values

By Enzo Soler

Illustration: a laptop on a dark desk with a thin stream of glowing paper cards rising from its screen and sorting themselves into three stacks of different heights
Image: AI-generated illustration (Google Gemini)

Cisco Talos found VOLTA, a Windows infostealer that sends a profile of each victim to an AI model through OpenRouter, with Claude Opus 4.6 as the default and Kimi K2 or Gemini 2.5 Flash as fallbacks, to rank what to sell first. It takes browser cookies, Slack and Discord sessions, SSH keys and crypto wallets.

If a Windows PC on your team gets infected with VOLTA, assume every logged-in session on it is gone: browser cookies, Slack, Discord, Telegram, Microsoft sign-ins and SSH keys. Cisco Talos documented the stealer on October 31. What makes it new is the last step. VOLTA sends a profile of each victim to an AI model and asks it to rank what is worth selling first.

What VOLTA takes and how the AI step works

Confirmed in Talos’s analysis, published October 31:

  • What it steals: saved passwords, cookies and payment cards from Chromium browsers and Firefox, plus Thunderbird and Outlook profiles, Slack workspaces, Discord tokens, Telegram sessions, Steam and Battle.net sessions, Roblox accounts, Microsoft OAuth tokens, SSH keys, cloud and VPN config files, Wi-Fi passwords, screenshots and crypto wallets. It runs a built-in cracker against wallet vaults.
  • How it beats Chrome’s protection: it gets around Chrome’s App-Bound Encryption by launching Chrome in headless mode.
  • How it confirms who you are: with the stolen Gmail session, it searches for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address. It also pulls order history from stolen Uber Eats and DoorDash sessions.
  • The AI step: VOLTA packs the victim’s location, address, employer, inferred birth year, card last four digits, Slack workspaces and more into one report. It sends that to an AI model through OpenRouter, a service that resells access to many models. The default is Claude Opus 4.6. If the answer contains refusal phrases, it retries with Kimi K2, then Gemini 2.5 Flash. The prompt tells the model to act as “a forensic intelligence analyst drafting a target assessment.”
  • The output: a file with a “WHAT THEY’RE WORTH” section that ranks the victim’s assets by how easily they can be sold, and a “THEIR OPSEC” section that grades their password habits.
  • Without a key: if no API key is set, VOLTA skips the AI step and works as an ordinary stealer.
  • Cleanup: the main program can delete itself after it runs.

Talos says the sample was first seen on October 11 and may be sold as a builder service, where each buyer gets a custom copy. It does not say how VOLTA reaches a PC or name any victims. Tom’s Hardware reported the findings on November 1. Neither OpenRouter nor Anthropic had commented in either report.

What to do this week

1. Watch for headless Chrome. Talos’s main defense: block or at least alert when an unexpected program launches Chrome with --headless. If you run endpoint management for a small team, add that rule.

2. Move secrets off the disk. Talos recommends hardware-backed credential storage. In practice that means passkeys or a hardware security key for the accounts that matter, and no plaintext seed phrases or .env files in a home folder.

3. If a PC was infected, revoke before you reset. A new password does not end a stolen session. Sign out of all sessions in Google, Microsoft, Slack and Discord, revoke API and SSH keys, then change passwords. Talos also asks responders to keep the file %APPDATA%\volta_debug.txt, which logs what was taken.

4. Treat a plaintext wallet seed as burned. Talos’s advice: move the funds to a new wallet created on an offline device.

Your session cookies are the asset

Our read, as inference: the AI step does not steal anything new. It sorts the haul faster, so the accounts with the most value get used first. For a founder or IT lead, those are the logged-in Google, Microsoft and Slack sessions on a work laptop. It is the same lesson as the Northflank breach and the Claude Code extension backdoor: the tokens on a developer’s machine are worth more than its passwords. The fix is the same too. Fewer long-lived sessions, keys that can be revoked in one place, and a short list of who holds them.

Reported by Tom’s Hardware, with Cisco Talos’s analysis as the primary source.

One email when a review goes up. Unsubscribe from any of them.