VOLTA

VOLTA, self-named VOLTA-AUTODOXER, is a self-deleting Windows information stealer with an optional large-language-model-assisted victim-profiling workflow. It collects browser passwords, cookies, saved payment cards, authentication tokens, messaging and gaming sessions, SSH keys, cloud credentials, saved Wi-Fi passwords, screenshots, and cryptocurrency wallet data and seed phrases. Its targets include Chromium-based browsers, Firefox, Thunderbird, Outlook, Slack, Discord, Telegram, Steam, Battle.net, and Roblox. An embedded wallet-vault cracker supplements its cryptocurrency theft capabilities. Its token-theft workflow includes bypassing Chrome App-Bound Encryption using headless Chrome.

VOLTA enriches stolen information by reusing authenticated sessions to query accounts and services. It searches Gmail receipts to corroborate home addresses, retrieves food-delivery order histories, enriches Discord profiles, and estimates Roblox inventory values. It combines these results with geolocation, employer information, document authorship metadata, and other personal records to build a structured victim profile.

When an API key is configured, VOLTA submits the evidence through OpenRouter for an assessment of monetizable assets, security posture, and password hygiene. Its configured model sequence uses Claude, followed by Kimi and Gemini when requests fail or responses contain refusal language. These requests execute from the victim's machine over the victim's network connection. The malware can operate without this AI stage.

VOLTA supports staged exfiltration of initially harvested data, AI-generated assessments, and additional enrichment results, with Telegram used to deliver collected material to operators. Embedded configuration credentials are encrypted using a key derivable from constants in the binary. Build-time configuration supports operator-specific destinations and API credentials. Observed communications use third-party services rather than identified actor-owned infrastructure.