On Oct. 31, 2026, Cisco Talos said researchers had identified the VOLTA infostealer, also tracked as Volta-Autodoxer.
Cisco Talos said on Oct. 31, 2026, that VOLTA is a self-deleting Windows infostealer. It erases itself after running and harvests stored browser logins, active website sessions, cryptocurrency wallets, payment-card details and other personal data. Talos described it as “a mature stealer implant with an optional AI-integration layer.”
Cisco Talos reported on Oct. 31, 2026, that VOLTA relies on large language models to build victim profiles. It sorts the data it has taken by how profitable each target might be.
Cisco Talos noted on Oct. 31, 2026, that VOLTA runs a multimodel setup with a backup chain of as many as three models. It also uses a low hardcoded temperature of 0.2, an AI setting that limits randomness, to work around model refusals and keep outputs accurate.
Cisco Talos stated on Oct. 31, 2026, that VOLTA is a builder model, a toolkit for generating malware copies, built around a template that offers six slots operators can swap. The malware relies on no infrastructure owned by the actor.
Infostealers gather sensitive credentials, active sessions and private keys from infected devices to support cybercrime operations, according to research on infostealer victims. Cisco Talos has described a broader move toward embedding AI features into malware platforms.
Join the discussion