VOLTA Stealer Ranks Stolen Credentials Into Victim Dossiers

A Windows stealer called VOLTA harvests browser passwords and sessions, wallet material, Microsoft OAuth tokens, SSH and cloud keys. Cisco Talos found it also uses stolen Gmail and delivery-app sessions to check receipts and order histories for a home address. It builds Identity_Report.txt on the infected host, asks OpenRouter to rank the victim’s valuables, and receives AI_Analysis.txt before sending both in volta_dox.zip. The stealer can run without the model call.

Start with Windows hosts where an unexpected process launches Chrome with --headless. Talos recommends an application-control rule limiting which processes may launch headless Chrome to block its described App-Bound Encryption decryption path. In Microsoft Defender XDR, the Defender for Endpoint DeviceProcessEvents schema gives you ProcessCommandLine and InitiatingProcessFileName to inspect that launch chain; legitimate developer automation needs an allowance.

Preserve %APPDATA%\volta_debug.txt on a suspect host. Talos says this timestamped harvest record survives the executable’s self-deletion and records what was collected and whether the model call worked. Revoke exposed sessions and tokens, change passwords, rotate affected SSH and cloud keys, and move funds from any wallet whose seed was in plaintext to a newly generated air-gapped seed. Compare those changes against the harvest log.