VOLTA Infostealer: AI-Driven Victim Prioritization

VOLTA-AUTODOXER is a Windows-based infostealer that automates victim prioritization using LLMs. After harvesting browser passwords, session tokens, cryptocurrency wallets, and cloud provider keys, the malware serializes the data into a structured evidence bundle. This bundle is exfiltrated to OpenRouter, where an LLM is prompted to analyze the victim's worth and security posture. The malware is self-deleting and incorporates a multi-model fallback mechanism to bypass potential model refusal guardrails.

Attack Chain

1. Initial infection and execution of the self-deleting Windows infostealer.
2. Harvesting of sensitive data including browser credentials, cookies, and session tokens.
3. Collection of cryptocurrency wallet seed phrases and cloud provider keys.
4. Enrichment of the data bundle using stolen session access (e.g., searching Gmail and order history).
5. Serialization of the collected data into a structured evidence bundle.
6. Exfiltration of the bundle to OpenRouter via HTTPS POST.
7. Automated analysis by an LLM providing monetization rankings and security posture assessment.
8. Deletion of the binary from the infected system to prevent forensic recovery.

Impact

Successful infection results in the exposure of high-value credentials, financial information, cryptocurrency assets, and session tokens, which are actively prioritized by LLMs for maximum monetization.

Recommendation

• Block egress traffic to openrouter.ai at the corporate network perimeter to prevent LLM-based victim profiling by this specific malware strain.
• Implement EDR policies to detect and alert on the execution of unknown binaries from suspicious directories or temporary paths before they self-delete.
• Audit and restrict access to saved browser credentials and session tokens via enterprise browser management policies.
• Monitor for anomalous API calls or high-volume HTTPS POST requests to AI service providers from endpoints.