# Cisco Talos Finds Windows Infostealer Configured to Use Claude for Victim Triage > Source: > Published: 2026-11-02 12:20:24.447146+00:00 # Cisco Talos Finds Windows Infostealer Configured to Use Claude for Victim Triage - VOLTA is configured to send a locally assembled evidence bundle through OpenRouter, using Claude Opus 4.6 by default and Kimi K2 and Gemini 2.5 Flash as fallbacks if refusal phrases are detected. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) - The stealer can collect browser credentials, cookies, payment cards, wallet data, service sessions, cloud configurations and Wi-Fi passwords, then enrich the profile through stolen Gmail and delivery-app sessions. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) - Talos published one SHA-256 hash, two observed filenames, archive names and a recommendation to restrict unauthorized Chrome launches with the --headless option. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) - The public evidence shows a capability in one analyzed sample, not the scale of a campaign: no victim total, delivery method, affected geography or completed AI-generated dossier has been confirmed. [\[2\]](https://groundtruth.day/news/volta-infostealer-model-driven-victim-triage.html)[\[3\]](https://tsnmedia.org/volta-infostealer-ai-victim-ranking/) Cisco Talos has identified a Windows infostealer configured to use a commercial language model to rank the potential value of stolen victim data. The malware, which calls itself VOLTA-AUTODOXER, sends a structured dossier through the OpenRouter API to Anthropic’s Claude Opus 4.6 by default, then checks for refusal phrases before trying Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) The AI stage follows a broad theft and enrichment operation. Talos says VOLTA can collect browser passwords, cookies and payment cards; cryptocurrency wallet data; Discord, Telegram, Steam and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider configuration files; Wi-Fi passwords and screenshots. It can also use stolen sessions to search Gmail receipts, retrieve food-delivery histories and estimate Roblox inventory values. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) ## The model is used after the theft VOLTA assembles the collected information locally in an Identity_Report.txt file and sends it to OpenRouter with a prompt telling the model to act as a “forensic intelligence analyst drafting a target assessment.” The requested output includes “WHAT THEY’RE WORTH,” which ranks monetizable assets by low, medium or high value, and “THEIR OPSEC,” an assessment of the victim’s security practices and password hygiene. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) Talos describes the model as a triage analyst rather than the mechanism that breaks into the computer. The returned data is saved as AI_Analysis.txt and can be packaged with the stolen material in volta_dox.zip. Other archive names documented by Talos include volta_log.zip and volta_doxnet.zip. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) The sample has no observed attacker-owned infrastructure. Talos says its third-party endpoints and six build-time configuration slots suggest a builder model in which customers receive customized copies. That is an inference from the binary’s design, not an identified seller, customer base or distribution operation. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) ## Sample details and defensive guidance Talos published the SHA-256 hash 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 for one PE32+ x86-64 sample. It was observed under the filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe, carried a reported PE timestamp of August 17, 2026, and was first seen by Talos on October 11, 2026. The report does not provide a downloadable malware sample. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) The main executable may delete itself after running. Talos recommends preserving %APPDATA%\volta_debug.txt when possible; the file records what the stealer collected and whether the model call succeeded. Responders should also search for the documented archive names and unusual requests to https[:]//openrouter[.]ai/api/v1/chat/completions, while accounting for legitimate use of OpenRouter and Telegram. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) Talos’s most specific prevention measure concerns Chrome. The report says much of VOLTA’s token theft depends on techniques involving Chrome’s App-Bound Encryption and recommends restricting which processes may launch Chrome with --headless. Organizations should alert on headless Chrome launches from unknown parent processes, revoke exposed tokens, reset passwords and treat a wallet as compromised if its seed phrase was stored in plaintext on the infected machine. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) ## What the evidence does not show Talos did not disclose a victim count, named victim, threat actor, infection route, campaign geography or financial loss. The first-seen date applies to the analyzed file; it is not an infection count or proof that the sample was observed on a victim’s computer. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/)[\[2\]](https://groundtruth.day/news/volta-infostealer-model-driven-victim-triage.html) Independent reviews of the report emphasize that the public evidence establishes model-routing logic and a requested assessment format, not a successful assessment of a real victim. Talos did not say that Claude, Kimi or Gemini returned the requested report, that a fallback was triggered in an incident, or that the resulting ranking changed an operator’s actions. [\[2\]](https://groundtruth.day/news/volta-infostealer-model-driven-victim-triage.html)[\[3\]](https://tsnmedia.org/volta-infostealer-ai-victim-ranking/) The same limitation applies to claims about reach. The sample’s Windows focus and broad collection features make the capability relevant to consumers and organizations, but no affected country or sector has been confirmed in the Talos report. Any claim that the campaign is global would go beyond the published evidence. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/)[\[2\]](https://groundtruth.day/news/volta-infostealer-model-driven-victim-triage.html) ## Anthropic’s public controls Anthropic had not published a statement specifically addressing VOLTA as of November 2, 2026, according to a review of its newsroom, threat-intelligence materials and reporting that checked for provider responses. [\[3\]](https://tsnmedia.org/volta-infostealer-ai-victim-ranking/)[\[4\]](https://www.anthropic.com/threat-intelligence) Anthropic’s public materials say it investigates real-world misuse through detection tools, enforcement teams, intelligence partners and open-source reporting. The company says it can ban accounts, update classifiers and safeguards, and in some cyber-misuse cases use probes or real-time intervention, including blocking traffic identified as malicious. Its usage rules prohibit unauthorized system access, malware installation and exfiltration of stolen data. [\[4\]](https://www.anthropic.com/threat-intelligence)[\[5\]](https://www.anthropic.com/research/zero-days) Those controls do not establish whether Anthropic received, blocked or investigated any VOLTA request. The malware routes through OpenRouter, and Talos did not identify the account, API key or provider-side response involved. For defenders, the actionable response remains endpoint and identity containment: identify the stealer, preserve the debug log, revoke sessions, rotate credentials and investigate what data was present on the machine. [\[1\]](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/)[\[3\]](https://tsnmedia.org/volta-infostealer-ai-victim-ranking/) ## Companies mentioned ## Further sources The stories that matter, in one email. Free — unsubscribe anytime.