VOLTA-AUTODOXER Infostealer Leverages LLMs for Victim Data Prioritization

VOLTA-AUTODOXER (aka VOLTA) is a Windows-based infostealer designed to offload data triage tasks to Large Language Models (LLMs). The malware harvests a wide array of sensitive data, including browser credentials, cookies, payment information, cryptocurrency wallet seeds, and session tokens for platforms like Discord, Telegram, and Steam. After collection, it serializes this data into an "evidence bundle" and routes it through the OpenRouter API to AI models - specifically Anthropic’s Claude, Moonshot AI’s Kimi, or Google’s Gemini - to generate a prioritized dossier on the victim, including a "WHAT THEY'RE WORTH" monetization assessment. Data exfiltration occurs in three stages via the Telegram messaging platform.

Attack Chain

1. Initial infection and execution of the VOLTA-AUTODOXER binary on the Windows host.
2. Harvesting of local credentials, session tokens, and configuration files from web browsers, Outlook, Slack, and cloud-provider keys.
3. Enrichment of the stolen dataset by searching local Gmail caches for purchase receipts (e.g., Amazon, DoorDash, Uber Eats).
4. Serialization of the collected artifacts into a structured evidence bundle.
5. Transmission of the evidence bundle to an AI-model API (OpenRouter) using a system prompt designed to force the model into the role of a forensic intelligence analyst.
6. Exfiltration of the raw data, LLM-generated assessment, and enrichment evidence to the operator via Telegram.

Impact

VOLTA enables operators to move beyond raw data collection to actionable, prioritized targeting. The use of AI for dossier generation provides immediate assessment of a victim's financial worth and security posture, which can significantly accelerate the effectiveness of subsequent phases like ransomware deployment or identity theft.

Recommendation

• Monitor for unauthorized or suspicious outbound traffic to the OpenRouter API domain and Telegram API endpoints.
• Audit and restrict the use of unauthorized AI API keys or environment variables (e.g., OPENAI_API_KEY, though VOLTA uses OpenRouter, similar LLMjacking patterns apply) within enterprise environments.
• Implement endpoint detection and response (EDR) rules to monitor for common stealer behaviors: bulk file access in browser/application profiles, unusual process spawning, and connections to messaging-based C2 services.
• Enforce policies to prevent the storage of plaintext credentials or long-lived session tokens on local disk.