VOLTAVOLTA

Self-deleting Windows (PE32+ x86-64) information stealer, self-named VOLTA-AUTODOXER, reported by Cisco Talos after surfacing through its CAIRN research toolkit. It harvests Chromium, Firefox and Thunderbird credentials, cookies and payment cards (bypassing Chrome App-Bound Encryption via headless Chrome), cryptocurrency wallets with an inline vault cracker, Outlook, Slack, Discord, Telegram, Steam, Battle.net and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider configuration and saved Wi-Fi passwords. It then enriches a victim profile with the stolen sessions (Gmail receipts to confirm a home address, Uber Eats and DoorDash order history, Discord data) and POSTs the bundle to OpenRouter under a system prompt asking for a "target assessment" ranking the victim's assets by monetization value; the default model is Claude Opus with a fallback chain to Kimi K2 and Gemini 2.5 Flash when the model refuses, and the stealer runs without the LLM stage if no key is configured. Results are exfiltrated to the operator's Telegram (volta_log.zip, volta_dox.zip, volta_doxnet.zip). A six-slot build template suggests a builder sold to customers. All observed endpoints are third-party services; Talos reports no actor-owned infrastructure and no attribution.