Talos (Cisco) analyzes a malware that asks AI models to rank victims' assets by value
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
VOLTA, a Windows data thief that deletes itself, sends a dossier on each victim to Claude Opus 4.6 through OpenRouter. Kimi K2 and Gemini 2.5 Flash take over, in that order, if the first model refuses. According to Talos, from Cisco, that backup chain suggests the attackers expect refusals, and the program relies on no infrastructure owned by them.
Talos, Cisco's threat research team, has published its analysis of VOLTA, a Windows program that steals data and deletes itself. The program calls itself "VOLTA-AUTODOXER" and came to light through CAIRN, one of Talos's research efforts.
After taking passwords, cookies, cards, cryptocurrency wallets and sessions, it builds a dossier on the victim and sends it to OpenRouter, a service that gives access to several AI models. By default it uses Claude Opus 4.6, from Anthropic, and if that one refuses, it moves on to Kimi K2, from Moonshot AI, and then to Gemini 2.5 Flash, from Google. To spot a refusal, it scans each reply for phrases such as "I can't" or "I'm not able".
The model has to rank the victim's assets by what can be gotten from them and assess their security. Its instructions ask it to act as a forensic intelligence analyst and write a target assessment, with each asset graded low, medium or high, plus an evaluation of the victim's security and password habits. The malware also searches the victim's Gmail for receipts to confirm their home address, looking at those from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal.
According to Talos, that chain suggests the attackers expect to run into refusals. The program can run without the AI stage if it has no key, and every endpoint Talos observed belongs to a third party: there is no attacker-owned infrastructure.
Talos thinks VOLTA is a product that is sold: its template has six swappable slots, holding for example the Telegram channel and the API keys, which are filled in when it is compiled, pointing to an author who sells access and builds a separate executable for each customer. That is Talos's interpretation, not a confirmed fact.
As countermeasures, Talos proposes restricting which processes can launch Chrome in "headless" mode (without a graphical interface), which would block the route VOLTA uses to get around Chrome's app-bound encryption, and keeping credentials in hardware-backed stores. If an infection has already happened, it advises keeping the file volta_debug.txt, which records what was collected and whether the call to the model worked, revoking any tokens that may be compromised and changing passwords.
Why it matters · analysis and opinion
What stands out is not the theft, which follows the usual pattern for programs of this kind, but what comes afterwards: the work of analyzing the haul and deciding which victim is worth the effort, which used to fall to a person, passes to a language model that returns a report with citations. Talos sees no extra speed or scale here, but a displacement of the operator's effort, and argues that the question for defenders is not whether the pattern will repeat but which phase it will reach next. That the program includes more permissive backup models indicates that one model's refusal does not stop the attacker: it is enough to move on to the next.
Official source: Talos (Cisco) · Written with the help of AI: how we make the news
What does it mean for your business? · analysis and opinion
This affects small businesses and freelancers in Spain and Latin America who work with Windows computers, especially if they store passwords and cards in the browser or always keep their email, Slack or Outlook sessions open. According to Talos, VOLTA also steals Microsoft access credentials (OAuth tokens), SSH and cloud-provider keys, and the passwords of every saved Wi-Fi network, and it notes who the victim works for. Anyone who does not use Windows is outside the reach of this particular program, although the precautions apply just the same.
Our advice, with measures that cost little: store passwords in a password manager instead of the browser, do not keep the company's cards saved from memory, and turn on two-step verification for email and business accounts. If a computer is suspected of being infected, the safe approach is to close all open sessions from another, clean device, change the passwords and revoke the cloud keys, because a stolen session can be enough to get in without knowing the password.
The underlying risk is that the AI ranks what has been stolen and flags which accounts are worth the most, so carelessness on a single laptop can expose email, payments and the cloud all at once. Since the program deletes itself, it is worth acting on any suspicion without waiting to find traces on the computer.
