SockAnalyst
← All playbooks
HighMalware · 2026-11-02

VOLTA infostealer uses AI models to rank victims by what they're worth

SockAnalyst · Security+ certified analyst.

What happened

Cisco Talos details VOLTA, a Windows infostealer that bundles stolen data and sends it through OpenRouter to an AI model (Claude Opus 4.6 by default, falling back to Kimi K2 and Gemini 2.5 Flash) to rank victims by financial value. It even searches the victim's Gmail for Amazon, DoorDash, Uber Eats, Walmart and PayPal receipts to confirm a home address, and exfiltrates over Telegram. Its config setup suggests a builder kit sold to customers.

Who's affected

Windows users and companies whose staff save browser logins, sessions, OAuth tokens, SSH or cloud keys, or crypto wallets on their machines.

✅ Fix / patch

  • Treat any infected machine as fully compromised: revoke Microsoft OAuth tokens and browser sessions, and rotate saved passwords, SSH and cloud keys.
  • Move high-value logins to phishing-resistant MFA so stolen cookies and passwords are worth less.
  • Block or alert on unapproved Telegram API traffic from corporate endpoints.

🔎 Quick hunt check

Use the file hashes and filenames in the Cisco Talos report. Also look for unexpected endpoint traffic to openrouter.ai or api.telegram.org from non-developer machines.

MITRE ATT&CK: T1555.003, T1539, T1552.004, T1567, T1102

IOCs

  • SHA-256 hashes: 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
  • Files / paths: 9BY0tjwOc3ut.exe, yLP9m5J3i2Aw.exe, %APPDATA%\volta_debug.txt, volta_log.zip, volta_dox.zip, volta_doxnet.zip
  • Domains: openrouter[.]ai (legitimate service abused), api.telegram[.]org (legitimate service abused)

Talos: no attacker-owned infrastructure.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=edr (file_hash="57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279" OR file_name IN ("9BY0tjwOc3ut.exe","yLP9m5J3i2Aw.exe","volta_debug.txt","volta_dox.zip","volta_log.zip","volta_doxnet.zip") OR (process_name="chrome.exe" CommandLine="*--headless*" NOT parent_process_name IN ("node.exe","python.exe")))
| stats count min(_time) as first by host, user, process_name, file_name, CommandLine
let h = "57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279";
union isfuzzy=true
 (DeviceFileEvents | where SHA256 == h or FileName in~ ("9BY0tjwOc3ut.exe","yLP9m5J3i2Aw.exe","volta_debug.txt","volta_dox.zip","volta_log.zip","volta_doxnet.zip")),
 (DeviceProcessEvents | where SHA256 == h or (FileName =~ "chrome.exe" and ProcessCommandLine has "--headless" and InitiatingProcessFileName !in~ ("node.exe","python.exe"))),
 (DeviceNetworkEvents | where RemoteUrl has_any ("openrouter.ai","api.telegram.org") and InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","telegram.exe"))
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, RemoteUrl, InitiatingProcessFileName

See all hunt queries →

⏱ CISA deadline

Not in CISA KEV as of Nov 14, 2026.

Sources

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →