A new Windows infostealer called VOLTA-AUTODOXER does not stop at stealing passwords. It packages what it took, sends the bundle to a language model, and returns a ranked dossier on how much the victim is worth to an attacker.

What happened

Cisco Talos published analysis on 31 October 2026 describing VOLTA, a self-deleting Windows stealer that surfaced through the company's CAIRN research effort. The implant harvests the standard haul: browser passwords and cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles and screenshots.

From that it assembles a structured evidence bundle covering geolocation, home address, employer and employer domain, inferred birth year, Slack workspaces, document authorship metadata and iPhone backup indicators. Using the stolen session it then searches the victim's Gmail for purchase receipts to corroborate an address.

The bundle is posted to OpenRouter with a 240-word system prompt that casts the model as a forensic intelligence analyst. The default is Claude Opus 4.6, falling back to Kimi K2 and then Gemini 2.5 Flash if a response is refused. Two output sections are demanded: one ranking the stolen assets by monetisation value, the other assessing the victim's security posture and password hygiene. The results are written to Identity_Report.txt and AI_Analysis.txt and exfiltrated to Telegram as volta_dox.zip.

Talos notes the malware carries a template with six build-time slots for the Telegram channel and API keys. That points to a builder kit sold to operators rather than one crew's private tool, which means the dossier capability is available to buyers with no skill of their own.

Who is affected

• Windows desktops where staff use email, browsers and saved sessions, which covers most SME estates.
• Microsoft 365 tenants: the stealer takes OAuth tokens, and a token survives a routine password change.
• Any workstation holding SSH keys or cloud-provider keys, including admin and finance laptops.
• Organisations whose staff sign into Slack, Discord or Steam on a work machine.

What to do now

Treat one infected laptop as a full identity compromise, not a malware cleanup.

• Revoke sessions and refresh tokens in Entra ID and force re-authentication, not just a password reset.
• Rotate every SSH key, cloud provider key and API key that was present on the machine.
• Change passwords for all accounts saved in the browser, then check the password manager for reuse across work and personal logins.
• Review Microsoft 365, Google and Slack audit logs for unfamiliar sign-ins, new mailbox rules and unusual search activity.
• Confirm endpoint protection alerts on credential and browser-store access, not only on the initial download.

What this means for South African businesses

Most South African SMEs run exactly the profile this tool is built for: Windows desktops, Microsoft 365 mail, a browser full of saved passwords, and SSH keys left on an administrator's laptop. The AI layer does not change who gets hit, it changes who gets hurt first, because a stolen credential log from a small firm is now sorted and priced automatically and can be escalated into a ransomware target within hours. The part local businesses will most often get wrong is the token: changing the password while leaving the refresh token alive keeps the attacker inside the mailbox.

Source: Cisco Talos - Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer.