Cisco Talos Details VOLTA Infostealer That Ranks Victims by Value, Including Roblox and Steam Accounts

Cisco Talos published research on Oct. 31, 2026, describing VOLTA, a Windows infostealer that sends what it steals to a language model and asks for the victim’s stolen data to be ranked by monetization value. Talos researcher Ryan Fetterman wrote the report, which tracks the malware as VOLTA-AUTODOXER.

The Hacker News reported the findings on Nov. 2. For readers in film, television, music and games, the list of stolen material spans work accounts and consumer gaming accounts in a single sweep.

What VOLTA Collects From an Infected PC

According to Talos, the stealer takes browser passwords and cookies, saved payment cards and crypto wallet seed phrases. It also takes Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud keys, Wi-Fi profiles and screenshots.

Talos also lists Outlook profiles and Slack workspaces. Talos says the malware builds a profile that can include a victim’s location, home address, employer, inferred birth year, card last-four digits, Slack workspaces and document authorship metadata.

It also uses stolen sessions to look further. Talos says it searches a victim’s Gmail for receipts to confirm a home address, pulls food-delivery order history and queries Discord with the stolen token. Wallet vaults are run through an embedded cracker.

Gaming accounts are part of the haul. Talos says Roblox inventory is valued through a live lookup on Rolimons, and that Steam and Battle.net sessions are also stolen.

VOLTA at a Glance
Talos lists a fallback chain of Claude Opus 4.6, then Kimi K2, then Gemini 2.5 Flash, and says the sample was first seen on Oct. 11, 2026.

How the Model Ranks What Was Stolen

After collection, VOLTA bundles the data and sends it through the OpenRouter service to a language model. The Hacker News reports that the prompt runs 240 words and casts the model as a forensic intelligence analyst.

The prompt requires set sections. One, headed “WHAT THEY’RE WORTH,” ranks valuables by how easily they can be turned into money, using low, medium or high tiers. Another, headed “THEIR OPSEC,” assesses the victim’s security posture and password habits, according to Talos.

Talos says the default model is Anthropic’s Claude Opus 4.6. If a reply contains refusal phrases such as “I can’t,” the malware tries Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash. The temperature is set at 0.2, and the malware can run without the model step if no key is present.

Data leaves the machine in up to three stages over Telegram. The first archive is sent after the stealer runs, the second after the model call, and the third if network enrichment returns results. Talos calls the approach “effort displacement,” because a model call replaces analysts’ work.

What Is Known About Distribution and Victims

Talos says the design points to a builder model, in which a seller supplies the tool and a customer fills in six template values at build time, including the Telegram channel and API keys. Talos presents this as an inference from the template.

Credentials in those slots are encrypted with a key derived from two constants in the binary, which Talos says anyone who reverses the file can recover. All endpoints it observed are controlled by third parties, and it did not identify infrastructure owned by the attacker.

The report gives a SHA-256 hash for the sample, a PE timestamp of Aug. 17, 2026 and a first-seen date of Oct. 11, 2026. Neither Talos nor The Hacker News gives a victim count, campaign size or financial total, and the report does not say whether Talos saw actual victims.

Gaming accounts are part of the haul, with Roblox inventory valued through a live lookup on Rolimons.

Steps Talos Recommends and Related Findings

Talos advises limiting which processes can launch Chrome with the headless flag, which would block the malware’s route to decrypting browser data, and alerting on headless launches from unknown processes. It also recommends storing credentials in hardware-backed stores.

For a machine already infected, the report says to preserve the file volta_debug.txt in the AppData folder, which logs what was collected and whether the model call succeeded. Potentially compromised tokens should be revoked and passwords changed. Any wallet whose seed phrase sat in plaintext should be moved to a new wallet.

The report arrives days after another Talos finding. On Oct. 29, Talos described NIK C2, a Go-based Windows remote-access framework with more than 52 commands, according to Infosecurity Magazine. If an operator supplies no key, its OpenAI client reads the victim’s OPENAI_API_KEY environment variable, so Talos said the victim’s payment method would be charged and access logs would show the victim’s key.

Talos assessed with moderate confidence that NIK C2 is a fully functional framework rather than a proof of concept.