New Windows infostealer malware called Volta-Autodoxer uses commercial LLMs to gather information about potential victims and rank them on the basis of their profitability.

Volta harvests data including browser passwords, cookies, payment cards and cryptocurrency wallet seed phrases, along with Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles and screenshots.

It builds a structured evidence bundle about the person, containing geolocation and home address, employer and employer domain, inferred birth year, cards' last four digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation.

It then goes even further by using stolen session access to search the victim's Gmail for purchase receipts to corroborate a home address, pull delivery service order history, and enrich Discord accounts via the stolen token.

"What really sets Volta apart from commodity stealers is what comes after the initial collection. There is a live enrichment pass that leverages stolen sessions to deep-dive into the victim's data," said Cisco Talos researcher Ryan Fetterman.

"For example, using the victim's own authenticated Gmail tokens, it queries their inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal, then reviews those receipts to establish a confirmed home address. Stolen Uber Eats and DoorDash sessions are called directly for order history."

The required output includes a section titled "WHAT THEY'RE WORTH", with the victim's assets ranked by their financial value into low, medium, and high-tier categories. A section on "THEIR OPSEC", meanwhile, contains an assessment of the victim's security posture and password hygiene.

A multi-model architecture means that Volta can fall back resiliently if its requests are refused, checking each response for phrases like "I can't" or "I'm not able," before passing on to a chain of up to three models.

"Model temperature controls the randomness and predictability of LLM-generated text. The low hardcoded temperature value – 0.2 – suggests the attacker is emphasizing accuracy and consistency," said Fetterman.

"The malware also employs a chain of cascading models in the event of failures. This multi-model architecture suggests that the operator is anticipating encountering refusals, with the fallback pivoting to a few smaller and more permissive models."

Taking countermeasures, said Cisco, is helped by the fact that much of Volta's token-stealing capability relies on techniques to bypass App-Bound Encryption (ABE) in Chrome. This means that an application control policy that restricts which processes may launch Chrome with – headless would block the ABE decryption path entirely. Users can also alert when Chrome is launched with – headless from any process not in a known developer, Cisco said.

If worse comes to worst, in the event of compromise, the main executable may have deleted itself, but users should attempt to preserve the "APPDATA%\volta_debug.txt" file – a timestamped harvest log that contains a record of exactly what was collected and whether the LLM call succeeded.

Users should revoke any potentially compromised tokens and change passwords, Cisco said. Meanwhile, for cryptocurrency wallets, if the seed phrase was in plaintext on disk, they should treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device.