SockAnalystVOLTA infostealer uses AI models to rank victims by what they're worth
What happened
Cisco Talos details VOLTA, a Windows infostealer that bundles stolen data and sends it through OpenRouter to an AI model (Claude Opus 4.6 by default, falling back to Kimi K2 and Gemini 2.5 Flash) to rank victims by financial value. It even searches the victim's Gmail for Amazon, DoorDash, Uber Eats, Walmart and PayPal receipts to confirm a home address, and exfiltrates over Telegram. Its config setup suggests a builder kit sold to customers.
Who's affected
Windows users and companies whose staff save browser logins, sessions, OAuth tokens, SSH or cloud keys, or crypto wallets on their machines.
✅ Fix / patch
- Treat any infected machine as fully compromised: revoke Microsoft OAuth tokens and browser sessions, and rotate saved passwords, SSH and cloud keys.
- Move high-value logins to phishing-resistant MFA so stolen cookies and passwords are worth less.
- Block or alert on unapproved Telegram API traffic from corporate endpoints.
🔎 Quick hunt check
Use the file hashes and filenames in the Cisco Talos report. Also look for unexpected endpoint traffic to openrouter.ai or api.telegram.org from non-developer machines.
⏱ CISA deadline
Not in CISA KEV as of Nov 2, 2026.