VOLTA-AUTODOXER malware uses LLMs to rank stolen victim data

VOLTA-AUTODOXER is a new malware that steals browser passwords, payment cards, cryptocurrency seed phrases, and session tokens for platforms including Discord, Telegram, Steam, and Roblox. The software enriches this data by querying Gmail inboxes for purchase receipts from retailers like Amazon and Walmart, and pulls order history from Uber Eats and DoorDash. It also extracts saved Wi-Fi passwords and runs an embedded cracker against cryptocurrency wallets. The malware is self-deleting and relies entirely on third-party infrastructure, avoiding attacker-owned endpoints.

The stolen data is serialized into a JSON bundle and sent to OpenRouter with a system prompt instructing the model to act as a forensic intelligence analyst. The LLM output must include sections ranking valuables by monetization tier and assessing the victim's operational security. To handle refusals, the malware uses a multi-model architecture that falls back to a chain of up to three models if the primary one declines the request. The configuration uses a hardcoded temperature of 0.2 to ensure consistency.

Defenders can attempt to preserve the 'APPDATA%\volta_debug.txt' file, which contains a timestamped harvest log and records whether the LLM call succeeded. The malware bypasses App-Bound Encryption in Chrome to steal tokens, a behavior that can be blocked by restricting Chrome launches with the --headless flag from unknown processes. Final analysis files are exfiltrated in a zip file named 'volta_dox.zip'.