VOLTA deb nomlangan o‘z-o‘zini o‘chiradigan Windows infostealer tijorat AI modellaridan foydalanib, o‘g‘irlangan hisob ma’lumotlari, sessiyalar va kriptovalyuta ma’lumotlarini ustuvor jabrlanuvchi baholashlariga aylantiradi.
Zararli dastur, o‘zi “VOLTA-AUTODOXER” deb nomlangan, keng qamrovli yig‘ish qobiliyatlari bilan avtomatlashtirilgan shaxsni boyitishni birlashtiradi.
Uning ajralib turadigan xususiyati — analitik autsorsing: ma’lumot yig‘ilgandan so‘ng, u katta til modelidan jabrlanuvchi kim ekanligini, u nimaga egaligini va qaysi aktivlar operator e’tiboriga loyiq ekanligini aniqlashni so‘raydi.
VOLTA OpenRouter’ga tuzilgan dalillar to‘plamini yuboradi va modelga “maqsad baholashini tayyorlayotgan sud-razvedka tahlilchisi” sifatida harakat qilishni buyuradi.
So‘ralgan hisobot “ULARNING QIMMATI NIMA” bo‘limini o‘z ichiga oladi, unda qimmatbaho narsalar past, o‘rta yoki yuqori monetizatsiya darajalariga reytinglanadi, shuningdek “ULARNING OPSEC” bo‘limi parol gigienasi va xavfsizlik holatini baholaydi.
Standart model — anthropic/claude-opus-4.6, undan keyin moonshotai/kimi-k2 va google/gemini-2.5-flash.
VOLTA javoblarda “Men qila olmayman” va “Men qodir emasman” kabi rad etish iboralarini tekshiradi, so‘ngra zaxira zanjir bo‘ylab o‘tadi.
Bu xavfsizlik himoya choralarini aniq kutadi, garchi modellarni almashtirish muvaffaqiyatli javobni kafolatlamasa ham.
VOLTA-AUTODOXER ish oqimi (Manba: Cisco Talos).
So‘rovlar qo‘lda yig‘ilgan JSON, brauzerga o‘xshash User-Agent va 0.2 harorat bilan ishlatiladi, bu esa izchil natijani afzal ko‘radi.
Xulosa so‘rovi buzilgan mashinadan kelib chiqadi, natijada hosil bo‘lgan dosye eksfiltratsiya qilinadi.
Cisco Talos tadqiqotchilari CAIRN tadqiqot harakati orqali zararli dasturni aniqladilar va bu ixtiyoriy razvedka qatlamini ochib berdilar, u buzilgan aktivlarni monetizatsiya qiymati bo‘yicha reytinglaydi, lekin dastlabki o‘g‘irlikni yo‘naltirmaydi.
VOLTA brauzer parollari, cookie’lar, to‘lov kartalari, kriptovalyuta seed-frazalari, Microsoft OAuth tokenlari, SSH kalitlari, bulut konfiguratsiyalari, Wi-Fi hisob ma’lumotlari va skrinshotlarni nishonga oladi.
Yig‘ish xabar almashish, o‘yin va ish joyi ilovalariga, jumladan Discord, Telegram, Steam, Roblox va Slack’ka ham tarqaladi. Ichki o‘rnatilgan yorish komponenti kriptovalyuta hamyon vault mazmunini tiklashga ham urinadi.
Tashkil etilgan yig‘ish maqsadlari (Manba: Cisco Talos).
Uning boyitish bosqichi o‘g‘irlangan autentifikatsiyalangan kirishdan qayta foydalanadi. Gmail qidiruvlari turar joy manzillarini tasdiqlash uchun xarid va yetkazib berish cheklarini oladi; Uber Eats va DoorDash sessiyalari buyurtma tarixini ochib beradi; Discord tokenlari qo‘shimcha hisob ma’lumotlarini ochadi. Jonli Rolimons qidiruvi Roblox inventar qiymatini baholaydi.
Bu topilmalar Identity_Report.txt fayliga aylanadi, unda shaxs, ish, joylashuv, moliyaviy va hisob ko‘rsatkichlari mavjud.
Model AIAnalysis.txt ni qaytaradi; ikkalasi voltadox.zip paketiga joylanadi. Boshqa yig‘ish bosqichlarini qo‘llab-quvvatlovchi alohida arxivlar — voltalog.zip va voltadoxnet.zip.
Olti qurilish vaqtidagi konfiguratsiya uyasi moslashtiriladigan quruvchi modelni ko‘rsatadi, lekin tijorat tarqatilishi tasdiqlanmagan.
Mijozga xos hisob ma’lumotlari bajariladigan fayl ichidagi doimiylardan olingan kalit yordamida shifrlanadi, bu himoyani teskari muhandislik orqali tiklash mumkin qiladi.
Kuzatilgan aloqalar hujumchiga tegishli infratuzilma emas, balki uchinchi tomon xizmatlariga tayanadi.
Himoyachilar Chrome’ni –headless bilan ishga tushiradigan kutilmagan jarayonlarni kuzatishi kerak, bu VOLTA’ning App-Bound Encryption chetlab o‘tish yo‘li bilan bog‘liq xatti-harakat.
Ruxsatsiz headless Chrome bajarilishini cheklovchi ilova nazorati bu yig‘ish texnikasini buzishi mumkin.
Javob beruvchilar %APPDATA%\volta_debug.txt faylini saqlab qolishlari kerak, bu bajariladigan fayl o‘chirilgandan keyin ham saqlanib qolishi mumkin bo‘lgan vaqt belgili yig‘ish jurnali bo‘lib, AI tahlili muvaffaqiyatli bo‘lganini ko‘rsatishi mumkin.
Tiklash choralari ochilgan sessiyalar va tokenlarni bekor qilish, parollarni qayta o‘rnatish va seed-frazalari buzilgan hamyonlardan aktivlarni ko‘chirishni o‘z ichiga oladi.
Kengroq bog‘liqlik — harakat almashinuvi. Talos’ning CLOSEDQUORUM bilan bog‘liq tadqiqoti modellar taktik implant harakatlarini tanlayotganini hujjatlashtiradi, garchi operatsion joylashtirish tasdiqlanmagan bo‘lsa ham.
VOLTA xuddi shu tamoyilni o‘g‘irlikdan keyingi tahlilga qo‘llaydi: tartibsiz yig‘ishni amaliy jinoiy ustuvorlikka aylantiradi, operator har bir o‘g‘irlangan yozuvni qo‘lda tekshirishiga hojat qoldirmaydi.
Shunday qilib, AI qatlami o‘g‘irlangan ma’lumot qanday baholanishini o‘zgartiradi, lekin asosiy hisob ma’lumotlari o‘g‘irligi va sessiya suiiste’molini manbada aniqlash zaruratini o‘zgartirmaydi.
A self-deleting Windows infostealer named VOLTA uses commercial AI models to turn stolen credentials, sessions, and cryptocurrency data into prioritized victim assessments.
The malware, self-named “VOLTA-AUTODOXER,” combines extensive collection capabilities with automated identity enrichment.
Its distinguishing feature is analytical outsourcing: after harvesting information, it asks a large language model to determine who the victim is, what they own, and which assets deserve the operator’s attention.
VOLTA submits a structured evidence bundle to OpenRouter, instructing the model to act as “a forensic intelligence analyst drafting a target assessment.”
Its requested report includes “WHAT THEY’RE WORTH,” ranking valuables into low, medium, or high monetization tiers, alongside “THEIR OPSEC,” assessing password hygiene and security posture.
The default model is anthropic/claude-opus-4.6, followed by moonshotai/kimi-k2 and google/gemini-2.5-flash.
VOLTA checks responses for refusal phrases such as “I can’t” and “I’m not able,” then advances through the fallback chain.
This explicitly anticipates safety guardrails, although switching models does not guarantee a successful response.
The VOLTA-AUTODOXER workflow (Source : Cisco Talos).
Requests use manually assembled JSON, a browser-like User-Agent, and a temperature of 0.2, favoring consistent output.
The inference request originates from the compromised machine before the resulting dossier is exfiltrated.
Cisco Talos researchers identified the malware, through their CAIRN research effort, revealing an optional intelligence layer that ranks compromised assets by monetization value rather than directing the initial theft.
VOLTA targets browser passwords, cookies, payment cards, cryptocurrency seed phrases, Microsoft OAuth tokens, SSH keys, cloud configurations, Wi-Fi credentials, and screenshots.
Collection extends across messaging, gaming, and workplace applications, including Discord, Telegram, Steam, Roblox, and Slack. An embedded cracking component also attempts to recover cryptocurrency wallet vault contents.
The organized collection targets (Source : Cisco Talos).
Its enrichment stage reuses stolen authenticated access. Gmail searches retrieve shopping and delivery receipts to corroborate residential addresses; Uber Eats and DoorDash sessions expose order histories; Discord tokens reveal additional account information. A live Rolimons lookup estimates Roblox inventory value.
These findings become Identity_Report.txt, containing identity, employment, location, financial, and account indicators.
The model returns AIAnalysis.txt; both are packaged into voltadox.zip. Separate archives, voltalog.zip and voltadoxnet.zip, support other collection stages.
Six build-time configuration slots suggest a customizable builder model, not confirmed commercial distribution.
Customer-specific credentials are encrypted using a key derived from constants inside the executable, making that protection recoverable through reverse engineering.
Observed communications rely on third-party services rather than attacker-owned infrastructure.
Defenders should monitor unexpected processes launching Chrome with –headless, a behavior associated with VOLTA’s App-Bound Encryption bypass path.
Application controls restricting unauthorized headless Chrome execution can disrupt that collection technique.
Responders should preserve %APPDATA%\volta_debug.txt, a timestamped collection log that can survive executable deletion and indicate whether AI analysis succeeded.
Remediation includes revoking exposed sessions and tokens, resetting passwords, and migrating assets from wallets whose seed phrases were compromised.
The broader connection is effort displacement. Talos’ related CLOSEDQUORUM research documents models selecting tactical implant actions, although operational deployment remained unconfirmed.
VOLTA applies the same principle to post-theft analysis: converting indiscriminate collection into actionable criminal prioritization without requiring an operator to inspect every stolen record manually.
The AI layer therefore changes how stolen information is assessed, not the underlying need to detect credential theft and session abuse at source.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.