Illustration, AI-generated from the story text. Tap a panel to read the story through it.
Cisco Talos on Saturday described VOLTA, an infostealer that hands its haul to a language model for appraisal.
After stealing , browser sessions, cards and crypto wallets, it builds a profile of the victim and sends it through to Claude Opus 4.6 at temperature 0.2, with a system prompt casting the model as "a forensic intelligence analyst drafting a target assessment."
If the reply contains a refusal phrase such as "I can't," VOLTA retries on Moonshot's Kimi K2, then Google's Gemini 2.5 Flash.
The required output includes a section headed "WHAT THEY'RE WORTH," ranking the victim's assets into low, medium and high tiers by how easily they can be cashed out, and another assessing the victim's password habits.
VOLTA also uses the stolen sessions to fill gaps, reading Gmail receipts to confirm a home address and pricing Roblox inventories.
Talos first saw a sample on October 11th.
The fallback chain is the detail defenders should take from it: a refusal from one provider costs the attacker a single retry on another.
A new infostealer sends each victim's data to Claude and asks what they are worth
Cisco Talos on Saturday described VOLTA, an infostealer that hands its haul to a language model for appraisal. After stealing credentials, browser sessions, cards and crypto wallets, it builds a profile of the victim and sends it through OpenRouter to Claude Opus 4.6 at temperature 0.2, with a system prompt casting the model as "a forensic intelligence analyst drafting a target assessment." If the reply contains a refusal phrase such as "I can't," VOLTA retries on Moonshot's Kimi K2, then Google's Gemini 2.5 Flash.
The required output includes a section headed "WHAT THEY'RE WORTH," ranking the victim's assets into low, medium and high tiers by how easily they can be cashed out, and another assessing the victim's password habits. VOLTA also uses the stolen sessions to fill gaps, reading Gmail receipts to confirm a home address and pricing Roblox inventories. Talos first saw a sample on October 11th. The fallback chain is the detail defenders should take from it: a refusal from one provider costs the attacker a single retry on another. SourcesA
Sources
- AAppraisal by AI: model-driven victim prioritization in the VOLTA infostealer (Cisco Talos)blog.talosintelligence.com
This story ran in the Afternoon Brief of October 31st 2026.