A Windows stealer called VOLTA takes browser credentials, sessions and wallet material, then uses the victim’s own sessions to assemble a more valuable target profile. Cisco Talos researcher Ryan Fetterman reports that the sample sends that profile to an AI service from the infected machine and packages the assessment with the stolen data. For a company laptop, the haul can include Microsoft OAuth tokens, SSH keys, cloud-provider keys and evidence about the person who uses them.

Talos published its analysis on October 31 after first seeing the sample on October 11. The immediate question for endpoint teams is whether a Windows host ran this stealer and which credentials, sessions and personal records it reached. The main executable deletes itself; a remaining harvest log can still tell responders what the sample collected.

Receipts enrich the stolen profile

VOLTA collects saved passwords, cookies and payment cards from Chromium browsers, plus material from Firefox, Thunderbird, Outlook, Slack and messaging or gaming accounts. It also targets Wi-Fi profiles, cryptocurrency wallets, screenshots, and SSH and cloud configuration files. Talos describes an embedded wallet-vault cracker and a report marker, WALLET VAULTS CRACKED, for its result. A plaintext seed phrase on disk is a separate emergency: anyone holding that phrase can control the wallet.

The second pass uses sessions already taken from the machine. VOLTA searches the victim’s Gmail for purchase receipts to corroborate a home address, requests Uber Eats and DoorDash order history, and enriches a Discord profile with its stolen token. An ordinary food-delivery receipt can confirm a home address alongside employer, payment and account clues already in the harvest.

Talos found the locally assembled profile in Identity_Report.txt. It includes details such as the employer and domain, inferred birth year, card last four digits, Slack workspaces and document authorship metadata. Those fields give the operator a way to sort an account dump by the person and assets behind it.

The model sorts assets on host

VOLTA serializes that profile and sends it to OpenRouter through the victim’s network connection. The instruction to the model calls for “a forensic intelligence analyst drafting a target assessment,” according to Talos. Its requested output ranks valuables under WHAT THEY’RE WORTH and assesses password hygiene under THEIR OPSEC. The reply lands in AI_Analysis.txt; the assessment and profile travel together in volta_dox.zip.

The shared API endpoint is https://openrouter.ai/api/v1/chat/completions.

The sample defaults to anthropic/claude-opus-4.6 and can try moonshotai/kimi-k2 and google/gemini-2.5-flash when responses contain refusal language. Talos also found that the stealer can run without the AI stage when no model key is configured. The model is doing operator triage after collection, while the theft itself still works without that call.

The archive names help reconstruct the sequence. Talos describes volta_log.zip after the initial harvest, volta_dox.zip after the model call, and volta_doxnet.zip when network enrichment produces material. Talos observed only third-party endpoints, including the shared OpenRouter service. Correlate OpenRouter requests with the originating host and process before treating them as VOLTA activity.

Hunt the Chrome launch chain

Talos identifies a Chrome App-Bound Encryption decryption path involving a process launching Chrome with --headless. Restrict the processes permitted to launch Chrome that way through application control, and alert on a headless launch by a process outside your approved developer tooling. This blocks the described Chrome decryption path; collection from other applications still requires separate containment.

In a fleet with Microsoft Defender for Endpoint, the Defender XDR DeviceProcessEvents reference identifies ProcessCommandLine for the new process and InitiatingProcessFileName for its launcher. This defensive query finds headless Chrome launches to review against approved automation:

DeviceProcessEvents
| where FileName =~ "chrome.exe" and ProcessCommandLine contains "--headless"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName

Inspect the launcher, account and surrounding endpoint activity before escalating a match. Legitimate automation can launch headless Chrome. This query depends on Defender for Endpoint process telemetry being deployed and available in Defender XDR; search additional endpoint telemetry if your fleet uses another sensor.

Preserve the host harvest record

On a suspect machine, preserve %APPDATA%\volta_debug.txt before cleanup. Talos says this timestamped log records exactly what was harvested and whether the model call succeeded, even when the executable has deleted itself. Compare the log’s collected categories with browser sessions, Microsoft OAuth tokens, SSH and cloud keys, and wallet material held on that host. Talos lists sample SHA-256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 and filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe for matching preserved files or endpoint records; a hash match is sample evidence, while a different build can evade that match.

Talos infers a possible builder model from six swappable configuration slots; treat it as a possibility when assessing other samples. Its report does not quantify compromised organizations. Scope the incident using host evidence and exposed accounts.

Revoke what the stealer reached

For an affected Windows endpoint, preserve volta_debug.txt, investigate unexpected Chrome launches with --headless, and enforce the application-control rule for approved headless Chrome launchers. Revoke potentially stolen sessions and tokens, rotate passwords and exposed SSH or cloud keys, and investigate account activity using the host’s harvest record. If a wallet seed phrase was stored in plaintext, move funds to a wallet with a seed generated on an air-gapped device, as Talos advises.

Verify that the approved headless-launch policy blocks an unapproved launcher in a controlled administrative test and still permits your approved automation. For a compromised host, compare the preserved harvest categories with actual token revocations, key rotations and wallet migration.