VOLTA Infostealer Cyprus: An LLM Ranks Each Victim

Cisco Talos has documented VOLTA, self-named VOLTA-AUTODOXER, a self-deleting Windows infostealer found through the CAIRN research effort. It empties browsers, wallets, chat sessions and cloud configs, then posts a JSON dossier to a commercial LLM for a ranked target assessment. Treat the VOLTA infostealer Cyprus case as a session-ranking problem: a stolen login can be marked high value before a person opens the log.

Why does a ranked victim brief change the risk for a Cyprus firm?

The brief changes which victims get attention first. By the time the AI stage runs, collection is finished and the model only adds judgment. Cisco Talos, which published the family through its CAIRN research effort, calls that model the operator’s triage analyst. It turns a raw credential log into a prioritized, citation-backed dossier of the victim and their monetizable assets.

Triage has always been the slow part of the stealer trade. Logs are sold in bulk, and a buyer still has to find the one with a live Microsoft 365 session at a payments firm. Talos calls the change effort displacement: sustained human attention becomes an API call. Volume was not the constraint. Attention was.

For a Cyprus EMI, an iGaming operator, a ship manager or a corporate service provider, one laptop is enough. It can hold SSO cookies, a cloud CLI profile, Slack access and the payments mailbox. A brief that marks the host high value and names the employer domain puts that laptop at the front of a queue. Session revocation then has less time.

Talos reports the same idea in a separate implant it names CLOSEDQUORUM, pointed at a different phase of an intrusion. The line Talos leaves defenders with is plain: the open question is not whether the pattern shows up again, but which phase a model call replaces next. VOLTA replaces the reading of the log.

Talos gives no intrusion vector, no victim count, no builder price and no operator name. A firm cannot wait for an attribution report before it checks whether workstation tokens can be revoked in minutes. Our piece on whether the SOC can see an intrusion is the matching test: a written incident file without session telemetry does not close that window.

Which corporate secrets land in the VOLTA evidence bundle?

Almost everything a browser and a few desktop clients remember. The collection matches a working day on a corporate laptop.

• Browsers and mail: saved passwords, cookies and payment cards from Chromium-based browsers, plus Firefox, Thunderbird and Outlook profiles.
• Work and chat: Slack workspaces, Discord tokens, Telegram sessions and Microsoft OAuth tokens.
• Remote access: SSH keys and cloud or VPN configs, including gcloud, OpenVPN and Hide.me.
• Games: Steam, Battle.net and Roblox sessions.
• Screen: screenshots taken on the host.

Microsoft OAuth tokens and cloud CLI files are what make a home infection a company incident. A live cookie or refresh token opens mail, files or a cloud console without the password, and often without a new MFA prompt. Resetting the password does not revoke that session.

Much of the token theft depends on getting past Chrome App-Bound Encryption. Google shipped ABE for cookies on Windows in Chrome 127, in July 2024, binding decryption to the real browser so a copied cookie database was no longer enough.

Talos describes VOLTA’s path only as launching Chrome headless. The research does not name a Chrome vulnerability. An application-control rule that stops unapproved processes from starting headless Chrome cuts off the path Talos describes. An alert on headless Chrome from a non-developer parent is the lighter form of that control.

Every saved Wi-Fi profile is dumped in plaintext through the Windows WlanGetProfileList API. On a laptop that has joined the office WLAN, that string is a key to the building network, not only to a cafe. Rotate it with the user secrets.

VOLTA does not stop at copying cryptocurrency wallets. An embedded cracker runs against the vault on the host and writes the result to a report line labeled WALLET VAULTS CRACKED. Talos does not describe the cracking method. If a seed phrase sat in plaintext on disk, treat the wallet as gone and move funds to a new seed created on an air-gapped machine.

The sample Talos shows is a 64-bit Windows executable, PE32+ x86-64. The PE timestamp reads 2026-08-17 20:35, and first seen is 2026-10-11 12:46 UTC, under the filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe. Compile times are trivial to forge, so use them as a hint. The report includes a SHA-256: take that value from Talos, not from a rewrite.

How does a stolen session become a home address and a price tag?

VOLTA reuses the victim’s authenticated sessions to log into those accounts and starts asking questions. Talos calls this a live enrichment pass. With a Gmail token, it searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal, looking for a delivery address that confirms home.

• Order history is pulled directly from Uber Eats and DoorDash sessions.
• The Discord token is reused to enrich the account profile.
• Roblox inventory is priced through a live lookup on Rolimons.

The vendor list leans toward US consumer brands. The report does not say that any build queries European shops or couriers. An authenticated inbox is still an identity oracle: a Limassol mailbox full of courier notices, airline bookings and utility bills answers the same question.

The bundle’s JSON fields include geolocation and home address, employer and employer domain, an inferred birth year, the last four digits of saved cards, Slack workspaces, document authorship metadata, iPhone backup indicators and a live Roblox account valuation.

Employer domain, Slack workspace names and document authorship are a corporate fingerprint. Data about one employee becomes a pointer at the employer, ready for whoever buys the log.

On disk, collection lands in Identity_Report.txt. The model reply is written to AI_Analysis.txt. Both travel out in an archive named volta_dox.zip. The model call runs on the infected PC, across that PC’s network connection, before the archive leaves.

That order matters in a breach review. The dossier leaves twice: once as the request to the inference provider, then again inside the zip. A hunt that looks only for volta_dox.zip misses the first disclosure. If the build has no API key, VOLTA skips the model and still keeps the raw report.

What is the model asked to judge?

The model is asked whether this person is worth the operator’s time, and why. The system prompt casts it as a forensic intelligence analyst drafting a target assessment, and it demands a short judgment with citations and two fixed headings.

• WHAT THEY’RE WORTH ranks valuables by monetization potential in low, medium and high tiers.
• THEIR OPSEC rates security posture and password hygiene.

The prompt wants inference, not another search. It invites the model to connect a name, an address or a university to patterns in passwords. Talos’s phrase is that the model is told to stretch the data rather than find it. The embedded line is: Go deep, not wide. Be blunt, specific, accurate.

The HTTP call is plain. VOLTA posts hand-built JSON to OpenRouter’s chat-completions API, with no SDK, and sets a generic Mozilla/5.0 User-Agent. Temperature is fixed at 0.2. Talos reads that low value as a bid for repeatable wording rather than creative prose.

Setting	What Talos reports
Default model	anthropic/claude-opus-4.6
First fallback	moonshotai/kimi-k2
Second fallback	google/gemini-2.5-flash
Temperature	0.2
Request	Hand-built JSON, no SDK, User-Agent Mozilla/5.0

If a reply contains a refusal such as “I can’t” or “I’m not able”, VOLTA moves to Kimi K2 and then to Gemini 2.5 Flash, up to three models. Talos treats that check as a sign the author expected guardrails. The report does not say how often any model refused or complied. No OpenAI model is named.

How is the VOLTA builder packaged?

How the builder is packaged says the most about who uses VOLTA. The binary is compiled from a template with six swappable slots, covering a Telegram channel, API keys and settings, that the builder fills at compile time. That is a sales pattern: the author ships a custom executable per customer.

Those slot values are encrypted, weakly. The key is a SHA-256 of two constants that sit in the same file. Talos’s reading is that the wrapping exists so customers feel their keys are not plaintext, not because it stops an analyst. Anyone who reverses the sample can recover them.

Infrastructure follows the same outsourcing. Talos states that every observed endpoint is controlled by a third party and that there is no actor-owned infrastructure. There is no private server to seize or sinkhole. Detection has to come from the endpoint, the proxy and the identity provider.

The AI dossier is therefore a product feature, not a private trick of one crew. A buyer with little tradecraft can point the stealer at machines and receive ranked assessments in Telegram. Sophistication sits in the build, not in the person who runs it.

The model stage is optional. With no key in the slot, the implant still steals and simply skips the analyst call. Outsiders cannot tell, from the research alone, what share of builds actually carry a key.

What does the VOLTA infostealer Cyprus incident still leave for a SOC?

The program deletes itself. The debug log may not. VOLTA writes a timestamped harvest log to %APPDATA%\volta_debug.txt recording what it collected and whether the LLM call succeeded. That file answers the first two questions: what left, and was a dossier written.

Start with these checks on any suspected Windows host:

• Files: volta_debug.txt under the user’s AppData\Roaming folder. Also look for Identity_Report.txt, AI_Analysis.txt and volta_dox.zip in user-writable paths if exfiltration stopped early. Preserve copies and timestamps before cleanup.
• Network: DNS, proxy and EDR records of OpenRouter chat-completions calls from a workstation. Weight POSTs that carry a bare Mozilla/5.0 User-Agent, come from a process that is not a browser, and skip any corporate AI gateway.
• Process: Chrome started headless by an unusual or unsigned parent, close in time to reads of browser credential stores, wallet folders, or .ssh and gcloud directories.
• Identity: new OAuth consents, sign-ins from unfamiliar IPs that replay an existing session, cloud CLI calls from new locations, and Slack or mailbox use outside the user’s pattern.

OpenRouter traffic is a lead, not a verdict. On assessments we regularly see developers call LLM APIs from laptops with personal keys, and that is the noise this implant sits in. Correlate destination, calling process, User-Agent, timing and reads of browser stores or cloud configs before you name it VOLTA.

Headless Chrome needs the same split. Test suites launch it on purpose, so a blanket ban creates outages and can still miss a renamed parent. The gap that shows up most often in an assumed breach assessment is containment that resets a password and leaves the stolen tokens alive.

What should a Cyprus EMI or iGaming operator do after browser tokens are stolen?

Contain the host, then kill sessions, then rotate secrets from a clean machine. Do it in that order.

1. Isolate the endpoint. Capture the artifacts above, plus browser process telemetry and proxy logs, before reimaging.
2. Revoke sessions and refresh tokens for the user in Entra ID or Google Workspace. Remove OAuth app grants and sign the user out of Slack and other SaaS tools.
3. Rotate SSH keys, cloud access keys, API keys and VPN credentials that were on the machine. Use the debug log as the inventory.
4. Change the keys for any office Wi-Fi network whose profile was saved on the device. VOLTA writes those keys in plaintext.
5. If the user holds payment, back-office or admin access, assume the brief rated them high, and widen monitoring on those systems for 30 days.

Regulatory clocks start when you know, not when a ransom note appears. The bundle can hold a home address, an employer, card fragments and live sessions, so a GDPR Article 33 assessment is in scope. Unless risk is unlikely, notify the Commissioner for Personal Data Protection within 72 hours, and tell the people affected without undue delay when the risk is high.

Record both recipients of the personal data: the attacker, and the third-party inference service that received the dossier from the PC. A review that logs only the zip understates the disclosure.

NIS2-covered entities have a second sequence: an early warning within 24 hours, an incident notification within 72 hours, and in general a final report within one month. For a CySEC firm, classify a stolen session that is reused against a payment or trading system, not only the laptop infection.

DORA has applied to in-scope financial entities since January 17, 2025, with its own classification and reporting rules. A Cyprus EMI that is only a micro-enterprise should check whether a lighter regime changes its clock before it copies a large-bank timeline, and it should still log that decision.

Where the identity provider allows it, turn on token protection, keep session lifetimes short, and require a compliant device in Conditional Access. Know which cloud keys sit on endpoints. Those session, consent and device checks are what OAuth and SSO security testing is built to show, and they are what make a second run of this stealer less useful.

FAQ

What is the VOLTA infostealer?

VOLTA, which calls itself VOLTA-AUTODOXER, is a self-deleting Windows infostealer documented by Cisco Talos through the CAIRN research effort. It steals browser credentials, session tokens, wallets and cloud keys, then can ask an LLM to rank the victim by monetization value.

Does the VOLTA stealer use Claude or ChatGPT?

It calls models through OpenRouter. The default is anthropic/claude-opus-4.6. If the reply looks like a refusal, it fails over to moonshotai/kimi-k2 and then google/gemini-2.5-flash. No OpenAI model is named in the research.

What files does VOLTA leave on a Windows PC?

Look for %APPDATA%\volta_debug.txt, which may survive self-deletion, plus Identity_Report.txt, AI_Analysis.txt and volta_dox.zip if exfiltration did not finish. Take the file hash from the Cisco Talos report.

Is VOLTA linked to a named threat group?

No. Talos names no operator or group. The six-slot build template suggests the author sells per-customer binaries. Every observed endpoint is a third-party service, with no actor-owned infrastructure.

Can an infostealer read corporate email after stealing a session?

Yes. A valid cookie or OAuth refresh token can open mail and cloud apps without the password and often without a new MFA prompt. Revoke sessions and refresh tokens, not only the password. VOLTA also uses a stolen Gmail session to search receipts.

If one laptop holds payment, admin or cloud sessions, measure how fast those tokens can be revoked before a ranked brief marks them worth using. Our NIS2 and DORA readiness work ties that revocation evidence to the reporting clocks that start once you know.