- VOLTA是一个成熟的盗取者植入，带有可选的AI-集成层。 VOLTA向LLM发送一个结构化证据捆绑
- 如果某型号拒绝进行目标评估，VOLTA会失败到三型号连锁，意味着直接的工程努力，并期望击中型号护栏。
- 这个偷盗者是自我删除，没有攻击者拥有的基础设施。 人工智能整合中的新颖之处在于，它并不支持传统的恶意软件能力，而是代表操作员担任情报分析员。
网络犯罪世界出现了一个新想法——投放宽网，窃取一切，让AI整理细节。 一个新的恶意软件“VOLTA-AUTODOXER”，通过CAIRN的研究工作浮出水面，是一个自行删除的Windows信息处理器，它用LLM驱动的受害者剖析阶段来扩充其盗窃后的工作流程。
在收割标准窃取器拖曳，包括浏览器密码；cookie；支付卡；加密货币钱包种子短语；Discord, Telegram, Steam，和 Roblox 会话；Microsoft OAuth 令牌；SSH 和云端提供者密钥；Wi-Fi 配置图谱；以及截图后，VOLTA 构建了一个结构化的关于机器背后人物的证据捆绑。 这个捆绑包含地理定位和家庭地址、雇主和雇主领域、推定的出生年份、最后4位数的卡片、Slack工作空间、文件作者元数据、iPhone备份指标以及现场Roblox账户估值。 然后，它利用失窃的会话访问来进一步丰富这批物品：搜查受害者的Gmail购买收据以证实家庭地址，拉出UberEats和DoorDash订购历史，并通过失窃的代币丰富Discord账户。
捆绑被序列化，POST化到OpenRouter，在一个系统提示下指示模型充当"一个法医情报分析师起草目标评估". 所需产出包括一个题为“What they're WORTH”的章节，其中贵重物品按货币化等级排列，分为低/中/高等级，以及关于“THEIR OPSEC”的章节，其中载有对受害人安全态势和密码卫生的评估。 该模型是运营商的分解分析师；它将原始的证明日志变成受害人及其可兑换资产的优先和引文支持的档案。
AI配置："深入，不广。 直率、具体、准确。”
VOLTA使用一个多模型的架构，如果一个模型的达到拒绝，则会回落，在传递到一个最多三个模型的链条之前，检查每个响应，如“我无法”或“我无法”等。
模型温带控制LLM生成文本的随机性和可预测性。 低硬编码温度值(0.2)表明攻击者强调准确性和一致性。 恶意软件在出现故障时还使用连锁模式。 这种多模式架构表明，运营商预计会遇到拒绝，而倒向几个较小、更宽容的模式。
该系统直接促使操作人员使用揭示案：对受害者是否适合作为目标进行简明的分析评估，并附有可审计的引用线索。
提示器也要求一些非寻常的东西，但agents优于：在零散和不相干的数据之间建立联系。 例如，鼓励受害者的姓名、住址或大学等联系人使用密码模式。 在这种情况下，这个模型并没有被要求寻找数据；而是被要求对数据进行伸展，并作出有用的推论，扩大被刮掉的东西的价值。
偷窃能力
VOLTA的能力与现代数字生活中制作的记录直接吻合，远远超出了基本的证书盗窃。 在一次通过中，窃取者可以提取浏览器的资质，饼干，并保存跨越Chromium的浏览器的支付卡。 它达到 Firefox和雷鸟，Outlook简介，Slack工作空间，Steam和Battle.net会话，Discord令牌，Telegram会话，Roblox账户，以及SSH和云端提供者配置文件(gcloud,OpenVPN,Hide.me). VOLTA不仅复制加密货币钱包
机器上每个保存的Wi-Fi密码都通过直接呼叫WlanGetProfileList并被丢弃到纯文本中。
真正将VOLTA和商品窃取者区分开来的是最初的收集之后。 有一张现场的致富证，例如，它利用受害人自己的经认证的Gmail代币，查询其收件箱，以了解Amazon、DoorDash、Uber Eats、Grubhub、Walmart和PayPal的收据，然后审查这些收据，以确定确认的家庭地址。 被盗的Uber Eats和DoorDash会话被直接称为秩序历史。 Discord令牌被重新使用，以丰富受害者的账户概况。 Roblox存货是通过现场“Rolimons[.]com”查询估价的。
收集和浓缩阶段完成后，数据就地汇编和编排成一个文件，称为“Identity Report.txt”。 这个文件在JSON和POSTed到OpenRouter时与系统提示一起被序列化成捆绑。 返回的有效载荷为“AI Analysis.txt”。 这两个文件在“volta dox.zip”中一起放出。
推论圆通完全通过受害者自己的网络连接，在他们自己的机器上，在结果被过滤之前发生。
部署模式
VOLTA不用硬编码其Telegram通道，API密钥，并直接设置到代码中(这有可能是某人写作工具个人使用时会做的)，而是使用一个有六个可互换插槽的模板，在构建时填充。
这说明这是一个建造者模式：作者出售访问，客户提供其值，构建者为每个订单编译自定义二进制。 这些空档的证书是加密的，但并不是有意义的。 键是坐在同一个二进制中的两个常数的SHA-256，但大概是在那里，因为客户期望他们的API键不会坐落在平文字上，而不是因为它提供了真正的保护。 任何推翻文件的人都可以收回。
如果VOLTA确实是一个商品化的恶意软件，那么AI的档案能力并不是作者为自己的业务发明的。 这个功能使任何高级程度的客户能够将其指向受害者，并开始在其Telegram收件箱中接受排名分明的目标评估。
这一恶意软件的所有观测端点都是第三方控制的。 没有由行为者拥有的基础设施。
反措施
VOLTA的许多信使偷盗能力依赖于绕过Chrome的App-Bound加密(ABE)的技术。 限制发布 Chrome的无头程序会完全阻断ABE解密路径的应用控制政策。 最少，当Chrome是发布时，您也可以发出警报 -- 无头来自已知开发者所没有的任何进程。 在硬件备份商店储存证书的最佳做法也适用。
在妥协的情况下，主可执行文件可能已经删除了自己，但用户应该尝试保存“APDATA %\volta debug.txt”文件。 这是一个时间标记的收割日志，记录了所收集的确切内容以及LLM呼叫是否成功。 撤销任何可能损坏的令牌并更改密码。 对于密码货币钱包，如果种子短语在磁盘上是纯文本的，则视钱包为完全失密，将资金转移到一个新的钱包上，在空气加载设备上生成种子。
结论
VOLTA是一个成熟的窃取者，后期增加了AI层，目的之一是：解除分析工作的操作者。 这里人工智能改进的轴心不是速度或规模，而是努力移位；在CLOSEDQUORUM中可以看到同样的逻辑，尽管应用到不同的阶段。 这些植入物反映了相同的根本逻辑：确定需要人类最持续关注的步骤，代之以模型召唤。 维权者的问题不是这种模式是否会在其他地方出现，而是下一个阶段。
注意的第二个趋势是预期会遇到拒绝模式的情况，以及采取恢复力建设的办法。 在这种情况下，它包括从Claude到Kimi到Gemini的后退链，如果不存在密钥，则完全没有LLM级的运行能力。 随着恶意软件中的AI集成逐渐成熟，拒绝应变能力可能成为标准设计要求。
这两种趋势背后的未决问题是，犯罪器械中的努力转移是否以有意义的方式改变了环境：降低业务底线、提高比额表上限，或者两者兼而有之。 网络犯罪行动始终是机会性的，而精密的酒吧总是低于假设，但宽网和宽网本身却有区别。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
- VOLTA is a mature stealer implant with an optional AI-integration layer. After stealing credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to an LLM to rank the victim’s assets by monetization value.
- If a model refuses to perform the target assessment, VOLTA fails over to a three-model chain, implying a direct engineering effort and expectation of hitting model guardrails.
- This stealer is self-deleting, and there is no attacker-owned infrastructure. The novelty in the AI-integration is that it is not supporting a traditional malware capability but working as an intelligence analyst on behalf of the operator.
There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics. A new malware self-named “VOLTA-AUTODOXER,” surfaced through the CAIRN research effort, is a self-deleting Windows infostealer that augments its post-theft workflow with an LLM-powered victim-profiling stage.
After harvesting the standard stealer haul, including browser passwords; cookies; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots, VOLTA builds a structured evidence bundle about the person behind the machine. This bundle contains geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation. It then uses stolen session access to enrich that bundle further: searching the victim's Gmail for purchase receipts to corroborate a home address, pulling UberEats and DoorDash order history, and enriching Discord accounts via the stolen token.
The bundle is serialized and POSTed to OpenRouter under a system prompt that instructs the model to act as "a forensic intelligence analyst drafting a target assessment." The required output includes a section titled “WHAT THEY'RE WORTH” with valuables ranked by monetization with a low/medium/high tier, and a section on “THEIR OPSEC” containing an assessment of the victim's security posture and password hygiene. The model is the operator's triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.
The AI configuration: “Go deep, not wide... Be blunt, specific, accurate.”
VOLTA uses a multi-model architecture to fall back resiliently if it hits a model’s refusal, checking each response for phrases like “I can’t” or “I’m not able,” before passing on to a chain of up to three models.
Model temperate controls the randomness and predictability of LLM-generated text. The low hardcoded temperature value (0.2) suggests the attacker is emphasizing accuracy and consistency. The malware also employs a chain of cascading models in the event of failures. This multi-model architecture suggests that the operator is anticipating encountering refusals, with the fallback pivoting to a few, smaller, and more permissive models.
The system prompt directly reveals the operator’s use case: Produce a concise analytical assessment of the victim’s suitability as a target, backed by an auditable trail of citations.
The prompt also asks for something out of the ordinary, but that agents excel at: making connections between sparse and disparate data. For example, encouraging connections like the victim’s names, addresses, or universities to patterns in their passwords. In this case, the model isn't being asked to find data; rather, it’s being asked to stretch the data and make useful inferences that extend the value of what has been scraped.
Stealer capabilities
VOLTA’s capabilities are directly aligned with the records produced in modern digital life, and well beyond basic credential theft. In a single pass, the stealer can extract browser credentials, cookies, and saved payment cards across Chromium-based browsers. It hits Firefox and Thunderbird, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, and SSH and cloud-provider config files (gcloud, OpenVPN, Hide.me). VOLTA doesn’t just copy cryptocurrency wallets, but runs an embedded cracker against the vault inline, writing the result to a WALLET VAULTS CRACKED line in its own report.
Every saved Wi-Fi password on the machine is pulled via a direct call to WlanGetProfileList and dumped to plaintext.
What really sets VOLTA apart from commodity stealers is what comes after the initial collection. There is a live enrichment pass that leverages stolen sessions to deep dive the victim’s data. For example, using the victim's own authenticated Gmail tokens, it queries their inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal, then review those receipts to establish a confirmed home address. Stolen Uber Eats and DoorDash sessions are called directly for order history. The Discord token is re-used to enrich the victim's account profile. Roblox inventory is valued via a live “Rolimons[.]com” lookup.
After the collection and enrichment stages are complete, the data is assembled and structured locally in a file called “Identity_Report.txt”. This file is serialized into a bundle as JSON and POSTed to OpenRouter along with the system prompt. The returned payload is received as “AI_Analysis.txt”. Both files exfil together in “volta_dox.zip”.
The inference round-trip happens entirely through the victim's own network connection, on their own machine, before the result is exfiltrated.
Deployment model
Instead of hardcoding its Telegram channel, API keys, and settings directly into the code (which is likely what someone writing a tool for personal use would do) VOLTA uses a template with six swappable slots, filled in at build time.
This suggests it’s a builder model: The author sells access, the customer provides their values, and the builder compiles a custom binary for each order. The credentials in those slots are encrypted, but not in a meaningful way. The key is SHA-256 of two constants sitting in the same binary, but it's presumably there because customers expect their API keys not to be sitting in plaintext, not because it provides real protection. Anyone who reverses the file can recover them.
If VOLTA is indeed a commoditized malware, then the AI dossier capability isn't something the author invented for their own operations. It is a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments in their Telegram inbox.
All the observed endpoints for this malware are third-party controlled. There is no actor-owned infrastructure.
Countermeasures
Much of the token-stealing capability of VOLTA relies on techniques to bypass App-Bound Encryption (ABE) in Chrome. An application control policy that restricts which processes may launch Chrome with --headless would block the ABE decryption path entirely. At minimum, you can also alert when Chrome is launched with --headless from any process not in a known developer. Best practices for storing credentials in hardware backed stores also apply.
In the event of compromise, the main executable may have deleted itself, but users should attempt to preserve the “APPDATA%\volta_debug.txt” file. This is a timestamped harvest log and contains a record of exactly what was collected and whether the LLM call succeeded. Revoke any potentially compromised tokens and change passwords. For cryptocurrency wallets, if the seed phrase was in plaintext on disk, treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device.
Conclusions
VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work. The axis of AI improvement here is not speed or scale but effort displacement; the same logic visible in CLOSEDQUORUM, though applied to a different phase. These implants reflect the same underlying logic: Identify the step that requires the most sustained human attention and replace it with a model call. The question for defenders is not whether this pattern will appear elsewhere, but which phase it touches next.
The second trend to watch is the anticipation of hitting model refusals, and the approaches to building in resiliency. In this case, it includes a fallback chain from Claude to Kimi to Gemini and the ability to run without the LLM stage altogether if no key is present. As AI integration in malware matures, refusal resilience may become a standard design requirement.
The open question underlying both trends is whether effort displacement in crimeware changes the landscape in a meaningful way: lowering the operational floor, raising the ceiling on scale, or both. Cybercrime operations have always been opportunistic, and the sophistication bar has always been lower than assumed, but there is a difference between a wide net and a wide net that sorts itself.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.