Cisco Talos published an analysis on 31 October, by Ryan Fetterman, of an infostealer it calls VOLTA. After it has finished robbing a machine, VOLTA writes a file called Identity_Report.txt and sends it to a language model with a prompt casting the model as a forensic intelligence analyst drafting a target assessment.

Malware calling a model is no longer new. We covered a command-and-control framework doing it two days earlier. The new part is what happens when the model says no.

The refusal is handled in code

VOLTA reads the response looking for refusal phrases, Talos names "I can't" and "I'm not able" among them, and when it finds one it moves to the next model in a chain.

The chain is explicit. Requests go to the OpenRouter chat completions endpoint. The default model is anthropic/claude-opus-4.6, and the fallbacks are moonshotai/kimi-k2 and then google/gemini-2.5-flash. Temperature is 0.2. The requests are hand-assembled JSON with no SDK and a browser user agent.

Read that as a design decision rather than an accident. Somebody wrote this expecting a model to decline, decided a decline was a routine error condition, and built a retry path across three vendors. Safety refusals are usually discussed as though a refusal ends the attempt. Here it costs the operator one network round trip.

Talos also notes the stealer runs perfectly well without the model stage if no key is present, so the dossier is an upsell rather than the engine.

What it sends, and what it asks for

The bundle is not a credential dump. Talos lists geolocation and home address, employer and employer domain, an inferred birth year, the last 4 digits of cards, Slack workspaces, document authorship metadata, iPhone backup indicators and a live Roblox valuation.

The output is required to have 2 sections. One is headed WHAT THEY'RE WORTH and ranks the victim's valuables by how easily they convert to money, on a low, medium and high scale. The other is headed THEIR OPSEC and assesses their security posture and password habits. The prompt asks the model to connect sparse details, names and universities among them, to likely password patterns. The answer is saved as AI_Analysis.txt.

So the model is not writing malware or finding bugs. It is doing the part a human operator would otherwise do by hand: reading a pile of stolen logs and deciding which victim is worth the next hour.

The theft underneath is thorough on its own

Browser credentials, cookies and saved cards from Chromium-based browsers, plus Firefox, Thunderbird and Outlook. Sessions for Slack, Steam, Battle.net, Discord, Telegram and Roblox. Microsoft OAuth tokens. SSH and cloud configuration for gcloud, OpenVPN and Hide.me. Screenshots. Cryptocurrency wallets, attacked inline by an embedded cracker that reports a line reading WALLET VAULTS CRACKED.

Every saved Wi-Fi password is pulled through the Windows profile API and written out in plaintext.

Then it enriches what it took, using the sessions it just stole: Gmail receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to corroborate a home address, food delivery order history, Discord profile details, and a Roblox inventory valuation from a public pricing site. Exfiltration runs in 3 stages, with the dossier archive going out after the model call. The sample then deletes itself.

There is nothing to block

The detail defenders will feel most is in the infrastructure section. Every endpoint Talos observed is third-party controlled, which leaves 0 attacker-owned domains or addresses to put on a blocklist. The operator rents everything and owns nothing, so the usual first move, blocking the command channel, has nothing to point at.

The configuration sits in a 6-slot template filled at build time, and the credentials in it are encrypted with a key derived from 2 constants in the binary, which means anyone willing to reverse the file can recover them.

Talos says this suggests a builder model, where the thing is sold and each buyer gets a configured copy.

Sample metadata, for hunting: the PE timestamp is 2026-08-17 and the file was first seen on 2026-10-11, which puts roughly 2 months between build and sighting.

What to do

  • Restrict which processes may launch Chrome with the headless flag, and alert when an unknown process does. Talos points at that as the path used to decrypt modern browser-bound credentials.
  • Move credentials into hardware-backed stores where the platform offers them.
  • After a suspected infection, preserve the debug log VOLTA leaves in the user profile before reimaging. It is the best record of what ran.
  • Revoke tokens rather than only changing passwords. OAuth tokens and session cookies survive a password reset.
  • Move wallets if seed phrases were ever stored in plaintext. The cracker runs on the host.
  • Stop treating a model refusal as an end state in your threat model. This sample treats it as a retry.

What is not established

  • Who wrote or operates it. Talos names no actor.
  • How it reaches a machine. The post does not describe initial access.
  • How many victims there are, or what the dossiers have been used for.
  • Whether it is sold and at what price. Talos says the build-time configuration suggests a builder model, which is an inference.
  • Whether any provider has acted on the activity. The post does not say.
  • Whether the fallback chain works in practice, or how often each model answers. Talos documents the code path rather than its success rate.