Cisco Talos has identified a Windows infostealer called VOLTA-AUTODOXER that steals gaming account sessions, browser credentials and financial information before optionally using artificial intelligence to assess the value of its victims. The malware targets Steam, Battle.net, Roblox and Discord alongside other online services, potentially exposing gaming accounts and digital assets to theft.
The security company detailed the malware in an October 31, 2026, technical analysis by researcher Ryan Fetterman. VOLTA combines conventional credential-stealing techniques with an unusual AI-powered profiling system that submits collected information to Anthropic’s Claude Opus 4.6 through the OpenRouter API. Its purpose is to help attackers identify which stolen accounts and personal information could be most valuable.
Unlike malware that uses AI to generate malicious code or discover vulnerabilities, VOLTA performs its initial data collection independently. The AI component comes afterward, analyzing information already gathered from an infected Windows computer.
VOLTA collects saved passwords, browser cookies, payment card information, cryptocurrency wallet recovery phrases and authentication tokens. Cisco Talos also identified functionality targeting Chromium-based browsers, Firefox, Thunderbird, Outlook, Telegram, Slack and several cloud services.
For PC gamers, the malware’s ability to extract Steam and Battle.net sessions is particularly relevant. Stolen authentication information can potentially allow attackers to access accounts without knowing their passwords, depending on the validity of the sessions and the platforms’ additional security protections.
Discord is another target. The malware collects authentication tokens and can reuse them to obtain additional account information. This introduces a separate security concern for gamers who use Discord to communicate, manage communities and connect with other players.
The threat is distinct from Discord’s planned public server message search changes, which concern the discoverability of server conversations rather than unauthorized account access.
Roblox receives additional attention in VOLTA’s data collection process. Cisco Talos found that the malware performs live Roblox inventory valuation using Rolimons, a third-party service that tracks Roblox item values. This allows the malware to include an estimated value of a victim’s Roblox inventory in its collected information.
That functionality could help attackers identify accounts holding valuable digital items, although the research does not establish that any particular Roblox inventory has been stolen through an active VOLTA campaign.
After collecting credentials and session information, VOLTA attempts to build a more detailed profile of the person using the infected computer. It can search an accessible Gmail account for purchase receipts and retrieve order histories from services including Uber Eats and DoorDash.
The resulting report can contain information such as the victim’s home address, location, employer, payment card details, account activity and Roblox inventory valuation.
VOLTA organizes the collected information into a local file named Identity_Report.txt. When its AI integration is enabled, the malware sends this report to OpenRouter, which provides access to multiple language models.
The default model configured in the analyzed sample is Claude Opus 4.6. Its instructions request an intelligence-style target assessment, including a section called “WHAT THEY’RE WORTH” that classifies potentially monetizable information into low, medium and high value categories.
Another section, “THEIR OPSEC,” assesses the victim’s security practices and password hygiene. The objective is to turn a large collection of stolen data into a structured report that helps the attacker decide which information deserves attention.
Cisco Talos found that VOLTA also includes a fallback mechanism designed to handle AI model refusals or failures. The malware checks responses for refusal-related phrases and can switch from Claude Opus 4.6 to Moonshot AI’s Kimi K2, followed by Google’s Gemini 2.5 Flash.
This behavior suggests that the malware’s developer anticipated unsuccessful model requests and incorporated alternatives. However, the presence of this fallback system does not establish how frequently the models produce usable assessments.
Importantly, AI is not essential to VOLTA’s operation. If the required API configuration is missing, the malware can skip the profiling stage and continue functioning as a conventional information stealer.
Cisco Talos also identified a self-deletion mechanism. After execution, VOLTA can remove its main executable, making the original payload less readily available for subsequent investigation.
Its collected information can be packaged into separate archives, including a credential collection archive called volta_log.zip and an AI analysis archive called volta_dox.zip. The latter can contain both the identity report and the model-generated assessment.
The analyzed malware also uses configurable build-time settings, leading Cisco Talos to suggest that VOLTA may have been designed as a product that different cybercriminal customers could configure for their own operations. That commercial distribution model remains an assessment rather than a confirmed sales history.
The technical analysis identifies a malware sample first observed on October 11, 2026. However, Cisco Talos has not established the scale of real-world deployment, confirmed a victim count or documented a specific infection campaign associated with VOLTA.
For Windows gaming PC owners, the immediate concern is the malware’s ability to steal credentials and active sessions from multiple gaming platforms and other services on the same computer. A compromised session can remain a security risk even after the account password is changed unless affected sessions are also revoked.
Users who suspect an infection should investigate the computer with trusted security software, avoid entering replacement passwords on a potentially compromised system, and secure affected accounts from a clean device. Changing passwords, terminating active sessions and revoking compromised authentication tokens are particularly important for Steam, Battle.net, Roblox, Discord and associated email accounts.
Enabling multifactor authentication provides additional protection against credential-based account access, although stolen active sessions can sometimes bypass the initial login process.
Cisco Talos additionally recommends preserving the malware’s debug log, if available, because it may indicate what information was collected before the executable deleted itself. The researchers warn that cryptocurrency wallet recovery phrases exposed in plaintext should be treated as compromised.
VOLTA’s distinctive feature is not the use of AI to break into accounts. It is the addition of automated victim assessment after conventional data theft, potentially reducing the amount of manual analysis attackers need to perform on stolen gaming credentials, digital inventories and personal information. The effectiveness of that AI-assisted prioritization in actual attacks has not yet been established.
