- VOLTA是一个成熟的盗取者植入，带有可选的AI-集成层。 VOLTA向LLM发送了一个结构化证据捆绑
- 如果某型号拒绝进行目标评估，VOLTA则未能完成三型连锁操作，这意味着直接的工程努力并期望击中型号护栏。
- 这个窃取者是自我删除的，没有攻击者拥有的基础设施。 AI-整合中的新颖之处在于，它并不支持传统的恶意软件能力，而是代表操作者担任情报分析员。
网络犯罪世界出现了一个新想法——投出一个宽网，窃取一切，让AI整理出具体内容。 一个新的恶意软件“VOLTA-AUTODOXER”，通过CAIRN的研究工作而浮出水面，是一个自行删除的Windows信息处理器，它用LLM驱动的受害人描述阶段来扩充其盗窃后的工作流程。
在收割了标准窃取器拖放，包括浏览器密码；cookie；支付卡；加密货币钱包种子短语；Discord,Telegram,Steam，和Roblox会话；Microsoft OAuth令牌；SSH和提供云密钥；Wi-Fi配置；以及截图后，VOLTA为机器背后的人构建了结构化的证据捆绑。 这个捆绑包含地理定位和家庭地址、雇主和雇主领域、推定的出生年份、最后4位数的卡片、Slack工作空间、文件作者元数据、iPhone备份指标以及现场Roblox账户估值。 然后，它利用被窃的会话访问来进一步丰富该捆绑：搜索受害人的Gmail购买收据以证实家庭地址，拉出UberEats和DoorDash订购历史，并通过被窃的代币来丰富Discord账户。
捆绑被序列化并被POST化为OpenRouter，在一个系统提示下指示模型充当"一名法医情报分析师起草目标评估". 所需产出包括一个题为“What they're WORTH”的章节，其中贵重物品按货币化、低/中/高等级排列，以及关于“THEIR OPSEC”的章节，其中评估了受害人的安全态势和密码卫生。 该模型是运营商的分型分析师；它将原始的认证日志变成受害者及其可货币资产的优先和引文支持的档案。
AI配置："走入深处，不是宽。 直率、具体、准确。”
VOLTA使用一个多模型架构，如果一个模型的达到拒绝，则会弹性地倒回，在传递到一个最多由三个模型组成的链条之前，检查每一个响应，如“我不能”或“我不能”等。
模型温带控制LLM生成文本的随机性和可预测性。 低硬编码温度值(0.2)表明攻击者强调准确性和一致性。 恶意软件在出现故障时还采用连锁模式。 这种多模式的架构表明，操作员预计会遇到拒绝，而后退则向少数较小和更宽容的模式倾斜。
该系统直接促使操作人员使用揭示案：对受害人是否适合作为目标进行简要的分析评估，并附上可审计的引用线索。
该提示也要求一些不寻常的东西，但agents优于：将零散和相去甚远的数据联系起来。 例如，鼓励受害者的姓名、地址或大学等联系人使用其密码。 在这种情况下，没有要求模型寻找数据；而是要求模型对数据进行伸展，并作出有用的推论，扩大被刮去的东西的价值。
偷窃能力
VOLTA的能力与现代数字生活中产生的记录直接相接，远远超出了基本的证书盗窃。 在一通通行证中，被窃取者可以提取出浏览器的资质，饼干，并保存了Chromium-based浏览器的支付卡。 它的达到 Firefox和雷鸟，Outlook简介，Slack工作空间，Steam和Battle.net会话，Discord令牌，Telegram会话，Roblox帐号，以及SSH和提供云的配置文件(gcloud,OpenVPN,Hide.me). VOLTA不仅复制加密货币钱包
机器上每个被保存的Wi-Fi密码都通过WlanGetProfileList的直通电话被取出并被丢入了平文本。
真正将VOLTA与商品盗取者区分开来的是最初收集之后的事物。 有一张现场的致富证，例如，它利用受害人自己的经认证的Gmail令牌，询问他们的收件箱，以便从Amazon、DoorDash、Uber Eats、Grubhub、Walmart和PayPal那里收到收据，然后审查这些收据，以确定确认的家庭地址。 被偷取的Uber Eats和DoorDash会话直接被叫来秩序历史。 Discord令牌被再用来丰富被害者的账户概况。 Roblox存货通过现场“Rolimons[.]com”查询估价。
在收集和浓缩阶段完成后，数据在名为“IDentity Report.txt”的文件中就地汇编和编排。 这个文件随着JSON和POSTed到OpenRouter与系统提示一起被序列化为捆绑。 返回的有效载荷作为“AI Analysis.txt”接收。 这两个文件在“volta dox.zip”中一起放出。
推论圆通完全通过被害者自己的网络连接，在他们自己的机器上，在结果被过滤出之前发生。
部署模式
VOLTA没有硬编码其Telegram通道，API密钥，而是直接设置到代码中(这有可能是某人写作工具的个人用途)，而是使用有六个可互换插槽的模板，在构建时被填入。
这说明这是一个建造者模式：作者销售访问，客户提供他们的值，而构建者为每个订单编译自定义二进制。 这些空档的证书是加密的，但并不是有意义的。 键是坐在同二进制中的两个常数中的SHA-256，但大概是在那里，因为客户期望他们的API键不会被平白地坐着，而不是因为它提供了真正的保护。 任何推翻文件的人都可以收回。
如果VOLTA确实是一个被商品化的恶意软件，那么AI的档案能力并不是作者为自己的操作所发明的。 这是一种功能，使任何层次的客户都能够将其指向受害者，并开始接收其Telegram收件箱中的排名目标评估。
这个恶意软件的所有观测端点都是第三方控制的。 不存在行为者拥有的基础设施。
反措施
VOLTA的大部分活字标记偷取能力依赖于绕过Chrome App-Bound加密(ABE)的技术。 限制发布 Chrome使用 -- 无头程序的程序控制政策将完全阻断ABE解密路径。 至少，当Chrome是发布时，您也可以发出警报 -- 无头来自已知开发者所没有的任何进程。 在硬件备份商店储存证书的最佳做法也适用。
在妥协的情况下，主可执行文件可能已经删除了自己，但用户应该尝试保存"APDATA%\volta debug.txt"文件。 这是一个时间标记的收割日志，记录了所收集的确切内容以及LLM呼叫是否成功。 撤销任何可能损坏的令牌并更改密码。 对于密码货币钱包，如果种子短语在磁盘上为平话，则视钱包为已完全失密，并将资金转移到一个新的钱包上，并用空气加载设备生成种子。
结论
VOLTA是一个成熟的盗取者，后期增加了AI层，目的只有一个：解除分析工作的操作员。 这里人工智能改进的轴心不是速度或规模，而是努力移位；在CLOSEDQUORUM中可以看到相同的逻辑，尽管应用到不同的阶段。 这些植入物反映了相同的基本逻辑：识别需要最需要人类持续关注的步骤并取而代之的是模型召唤。 维权者的问题不是这种模式是否会在其他地方出现，而是下一个阶段。
观察的第二个趋势是预期会遇到拒绝模式的情况，以及建立复原能力的办法。 在这种情况下，它包括从Claude到Kimi到Gemini的后退链和在没有密钥的情况下完全没有LLM级运行的能力。 随着恶意软件的AI集成逐渐成熟，拒绝应变能力可能成为标准设计要求。
这两种趋势背后的未决问题是，犯罪器械中的努力转移是以一种有意义的方式改变环境：降低业务底线、提高比额表上限，还是两者兼而有之。 网上犯罪行动始终是机会性的，而精密的栏杆一直低于假设，但宽网和宽网本身却有区别。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
- VOLTA is a mature stealer implant with an optional AI-integration layer. After stealing credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to an LLM to rank the victim’s assets by monetization value.
- If a model refuses to perform the target assessment, VOLTA fails over to a three-model chain, implying a direct engineering effort and expectation of hitting model guardrails.
- This stealer is self-deleting, and there is no attacker-owned infrastructure. The novelty in the AI-integration is that it is not supporting a traditional malware capability but working as an intelligence analyst on behalf of the operator.
There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics. A new malware self-named “VOLTA-AUTODOXER,” surfaced through the CAIRN research effort, is a self-deleting Windows infostealer that augments its post-theft workflow with an LLM-powered victim-profiling stage.
After harvesting the standard stealer haul, including browser passwords; cookies; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots, VOLTA builds a structured evidence bundle about the person behind the machine. This bundle contains geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation. It then uses stolen session access to enrich that bundle further: searching the victim's Gmail for purchase receipts to corroborate a home address, pulling UberEats and DoorDash order history, and enriching Discord accounts via the stolen token.
The bundle is serialized and POSTed to OpenRouter under a system prompt that instructs the model to act as "a forensic intelligence analyst drafting a target assessment." The required output includes a section titled “WHAT THEY'RE WORTH” with valuables ranked by monetization with a low/medium/high tier, and a section on “THEIR OPSEC” containing an assessment of the victim's security posture and password hygiene. The model is the operator's triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.
The AI configuration: “Go deep, not wide... Be blunt, specific, accurate.”
VOLTA uses a multi-model architecture to fall back resiliently if it hits a model’s refusal, checking each response for phrases like “I can’t” or “I’m not able,” before passing on to a chain of up to three models.
Model temperate controls the randomness and predictability of LLM-generated text. The low hardcoded temperature value (0.2) suggests the attacker is emphasizing accuracy and consistency. The malware also employs a chain of cascading models in the event of failures. This multi-model architecture suggests that the operator is anticipating encountering refusals, with the fallback pivoting to a few, smaller, and more permissive models.
The system prompt directly reveals the operator’s use case: Produce a concise analytical assessment of the victim’s suitability as a target, backed by an auditable trail of citations.
The prompt also asks for something out of the ordinary, but that agents excel at: making connections between sparse and disparate data. For example, encouraging connections like the victim’s names, addresses, or universities to patterns in their passwords. In this case, the model isn't being asked to find data; rather, it’s being asked to stretch the data and make useful inferences that extend the value of what has been scraped.
Stealer capabilities
VOLTA’s capabilities are directly aligned with the records produced in modern digital life, and well beyond basic credential theft. In a single pass, the stealer can extract browser credentials, cookies, and saved payment cards across Chromium-based browsers. It hits Firefox and Thunderbird, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, and SSH and cloud-provider config files (gcloud, OpenVPN, Hide.me). VOLTA doesn’t just copy cryptocurrency wallets, but runs an embedded cracker against the vault inline, writing the result to a WALLET VAULTS CRACKED line in its own report.
Every saved Wi-Fi password on the machine is pulled via a direct call to WlanGetProfileList and dumped to plaintext.
What really sets VOLTA apart from commodity stealers is what comes after the initial collection. There is a live enrichment pass that leverages stolen sessions to deep dive the victim’s data. For example, using the victim's own authenticated Gmail tokens, it queries their inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal, then review those receipts to establish a confirmed home address. Stolen Uber Eats and DoorDash sessions are called directly for order history. The Discord token is re-used to enrich the victim's account profile. Roblox inventory is valued via a live “Rolimons[.]com” lookup.
After the collection and enrichment stages are complete, the data is assembled and structured locally in a file called “Identity_Report.txt”. This file is serialized into a bundle as JSON and POSTed to OpenRouter along with the system prompt. The returned payload is received as “AI_Analysis.txt”. Both files exfil together in “volta_dox.zip”.
The inference round-trip happens entirely through the victim's own network connection, on their own machine, before the result is exfiltrated.
Deployment model
Instead of hardcoding its Telegram channel, API keys, and settings directly into the code (which is likely what someone writing a tool for personal use would do) VOLTA uses a template with six swappable slots, filled in at build time.
This suggests it’s a builder model: The author sells access, the customer provides their values, and the builder compiles a custom binary for each order. The credentials in those slots are encrypted, but not in a meaningful way. The key is SHA-256 of two constants sitting in the same binary, but it's presumably there because customers expect their API keys not to be sitting in plaintext, not because it provides real protection. Anyone who reverses the file can recover them.
If VOLTA is indeed a commoditized malware, then the AI dossier capability isn't something the author invented for their own operations. It is a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments in their Telegram inbox.
All the observed endpoints for this malware are third-party controlled. There is no actor-owned infrastructure.
Countermeasures
Much of the token-stealing capability of VOLTA relies on techniques to bypass App-Bound Encryption (ABE) in Chrome. An application control policy that restricts which processes may launch Chrome with --headless would block the ABE decryption path entirely. At minimum, you can also alert when Chrome is launched with --headless from any process not in a known developer. Best practices for storing credentials in hardware backed stores also apply.
In the event of compromise, the main executable may have deleted itself, but users should attempt to preserve the “APPDATA%\volta_debug.txt” file. This is a timestamped harvest log and contains a record of exactly what was collected and whether the LLM call succeeded. Revoke any potentially compromised tokens and change passwords. For cryptocurrency wallets, if the seed phrase was in plaintext on disk, treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device.
Conclusions
VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work. The axis of AI improvement here is not speed or scale but effort displacement; the same logic visible in CLOSEDQUORUM, though applied to a different phase. These implants reflect the same underlying logic: Identify the step that requires the most sustained human attention and replace it with a model call. The question for defenders is not whether this pattern will appear elsewhere, but which phase it touches next.
The second trend to watch is the anticipation of hitting model refusals, and the approaches to building in resiliency. In this case, it includes a fallback chain from Claude to Kimi to Gemini and the ability to run without the LLM stage altogether if no key is present. As AI integration in malware matures, refusal resilience may become a standard design requirement.
The open question underlying both trends is whether effort displacement in crimeware changes the landscape in a meaningful way: lowering the operational floor, raising the ceiling on scale, or both. Cybercrime operations have always been opportunistic, and the sophistication bar has always been lower than assumed, but there is a difference between a wide net and a wide net that sorts itself.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.