VOLTA Stealer Uses LLMs to Rank Victims by Financial Value

Researchers have detailed a Windows infostealer called VOLTA-AUTODOXER, identified during CAIRN research, that adds an unusual step to data theft: it hands the loot to a large language model, which assesses how much money the victim might be worth.

After harvesting the usual material, including browser passwords, cookies, payment cards, crypto wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud keys, and Wi-Fi profiles, VOLTA builds a structured profile of the device owner. It can include location and home address, workplace and company domain, estimated birth year, the last four digits of a card, Slack workspaces and signs of iPhone backups.

An AI analyst on the victim's machine

The malware then enriches the profile using stolen sessions. It searches the victim's Gmail for receipts from services such as Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls order history from Uber Eats and DoorDash, and queries Rolimons in real time to value a Roblox inventory.

The result is saved as Identity_Report.txt, converted to JSON and sent by POST request to OpenRouter. The system prompt tells the model to act as an analyst evaluating a target. The output includes a section called WHAT THEY'RE WORTH, which ranks assets as low, medium or high monetization potential, and THEIR OPSEC, which rates the victim's security and password quality. The temperature is fixed at 0.2, suggesting the operator wants consistent results.

If a model refuses, VOLTA switches to a chain of three others. Researchers say this points to deliberate engineering around built-in guardrails. The response is stored as AI_Analysis.txt, and both files are zipped as volta_dox.zip and sent to the attackers. The AI query runs through the victim's own network connection before anything reaches an external server.

Builder model and self-deletion

The stealer deletes itself after running and does not rely on attacker-owned infrastructure. Instead of hard-coding a Telegram channel address or API keys, it uses a template with six placeholder fields filled in at build time, which suggests a builder model where customers supply their details and receive a unique executable. The credentials in those fields are encrypted, but the key is a SHA-256 hash of two constants found in the file itself, so the protection is largely cosmetic.

The case shows how LLMs are moving from content generation into triage for criminals: the model is not asked to find data, but to link scattered fragments, such as names, addresses and schools, to the passwords a victim uses, and to prioritize targets.