A newly discovered Windows-based infostealer named VOLTA—also branded as VOLTA-AUTODOXER—goes beyond traditional credential theft by gathering data from Gmail, Discord, and other platforms, then feeding it to an AI model that creates detailed victim assessments. The malware erases itself after execution, complicating detection.
Data Harvesting Functionality
VOLTA infiltrates a victim’s system through malware typical of its class: stealing saved passwords, cookies, payment card info from Chromium-based browsers, and targeting tools like Firefox, Outlook, Telegram, Slack, Battle.net, Discord, Roblox, as well as cloud account files and SSH keys. It can even crack cryptocurrency wallet vaults. It captures Microsoft OAuth tokens, Wi-Fi credentials, and other sensitive session tokens to bypass login hurdles.
Beyond capturing credentials, VOLTA exploits logged-in Gmail sessions to extract receipts from services like Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal. These receipts help confirm physical home addresses. Meanwhile, it combs through Uber Eats and DoorDash order histories and uses existing Discord sessions to complete social profile data. For Roblox users, it checks the Rolimons site to determine the value of digital items, turning virtual goods into real financial insight.
AI-Driven Profiling
What distinguishes VOLTA is its final stage: building a dossier via AI. All harvested data is stored in an Identity_Report.txt file, which includes home address, city, employer, birth year estimate, payment card digits, workplace Slack channels, and more. This report is sent to OpenRouter, with instructions for it to act as a “forensic intelligence analyst drafting a target assessment.” The AI output must include sections on “WHAT THEY’RE WORTH,” evaluating the victim’s financial and digital assets, and “THEIR OPSEC,” assessing their security hygiene.
The default AI model used is Claude Opus 4.6. If it declines (looking for refusal patterns like “I can’t”), VOLTA falls back to Kimi K2, then Gemini 2.5 Flash. A low temperature setting (0.2) helps ensure responses are consistent and less random. The entire AI exchange happens using the victim’s own network to conceal command and control activity. Results are archived in a ZIP file (e.g. volta_dox.zip) alongside the identity report.
Reports suggest VOLTA is offered as a “builder” tool—buyers provide elements like Telegram channels and API keys to generate custom malware variants. Custom builds are reported back to the buyer, often via Telegram. No centralized command-and-control servers tied to specific attackers have been identified yet, making broad blocking impractical.
Detection, Indicators & Mitigation
Security researchers recommend preventing Chrome from launching with the --headless flag unless the initiating process is trusted. This could help block some of VOLTA’s token hijacking methods. If infection is suspected, victims are advised to preserve application logs (such as volta_debug.txt in %APPDATA%), revoke tokens, change passwords from uncompromised devices, and move cryptocurrencies if their seed phrases were exposed in plain text.
Key indicators of compromise include a specific SHA-256 sample hash, sample executable names like 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe, file timestamps from August 17, 2026, and first sightings in early October 2026. Malicious files like Identity_Report.txt, AI_Analysis.txt, logging in %APPDATA%\volta_debug.txt, and archive packages volta_dox.zip or volta_log.zip are all part of the malware’s typical footprint.
VOLTA is among the latest examples of threat actors integrating AI into cybercrime. It adds a layer of automation to the post-breach data evaluation process, helping attackers prioritize victims without labor-intensive manual review. While VOLTA has not yet been observed in real-world campaigns, its emergence signals growing sophistication in malware-as-a-service ecosystems where tools are productized.
What defenders should watch: AI-driven profiling that turns stolen credentials into actionable intelligence, builder-sold malware variants enabling wider distribution, and novel ways threat actors are evading protections like Chrome’s App-Bound Encryption. For everyone else, the rules are: reduce risk exposure, bolster credential hygiene, and stay alert to signs of illicit session use.
What it means: VOLTA demonstrates a shift in malware strategy—from pure theft to threat scoring and victim valuation. Organizations and individuals are at risk not just from having their data stolen, but from being ranked and targeted based on its value. As threat actors adopt AI to multiply scale and precision, protection demands more than traditional perimeter defenses. Key changes to watch include tighter controls over session tokens and broader use of AI detection in endpoint monitoring.
