> ## Content Index > Fetch the complete content index at: https://www.dailyferment.com/llms.txt > Use this file to discover other available public pages before exploring further. # VOLTA asks an AI what you're worth. A refusal just sends it to the next model. - URL: https://www.dailyferment.com/volta-infostealer-ai-ranks-victims/ - Published: 2026-11-01T13:00:00.000Z - Updated: 2026-11-01T12:59:59.000Z - Description: Cisco Talos found an infostealer that asks Claude to rank its victims and retries on Kimi and Gemini if refused. Where can a refusal still count? - Author: Rana Bilal Zafar - Tags: AI, Engineering, #reframe On Saturday 31 October 2026, Cisco Talos published its analysis of VOLTA, a Windows infostealer that does something new after the theft. It packs everything it took from a victim into one file and sends it through OpenRouter to Anthropic's Claude Opus 4.6, with instructions to rank what the person is worth. If the reply contains phrases like "I can't" or "I'm not able", VOLTA sends the same request to Moonshot's Kimi K2, then to Google's Gemini 2.5 Flash. So does a model saying no stop it? Not on its own. The refusal only matters if someone can see the retry. ## What does VOLTA actually do with the AI? The malware names itself VOLTA-AUTODOXER, and Talos says it surfaced through its CAIRN research effort. The stealing part is ordinary for this kind of malware: browser passwords, cookies and saved cards, crypto wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft sign-in tokens, SSH and cloud keys, saved Wi-Fi profiles, screenshots. Talos's Ryan Fetterman describes the next step. VOLTA uses the stolen sessions to fill in the gaps. It searches the victim's Gmail for purchase receipts to confirm a home address, pulls Uber Eats and DoorDash order history, and prices Roblox items through a live lookup. All of that goes into a file called Identity\_Report.txt. VOLTA sends it to the model with a system prompt that tells it to act as "a forensic intelligence analyst drafting a target assessment." The answer has to include a section headed "WHAT THEY'RE WORTH", with valuables ranked low, medium or high, and one called "THEIR OPSEC" on the victim's security habits. The temperature is set at 0.2, which keeps the answers steady from one victim to the next. **3**models in the chain: Claude Opus 4.6, then Kimi K2, then Gemini 2.5 Flash **0.2**temperature, so answers stay consistent from victim to victim **6**build-time slots, a sign it is sold to customers **0**servers owned by the attacker; every endpoint is a third party Source: Ryan Fetterman, Cisco Talos, 31 Oct 2026. Talos reads the code as a product, not a one-off. Instead of hardcoding its settings, VOLTA has a template with six slots filled in at build time, which suggests the author sells it and each customer supplies their own values. Two more details matter for what follows. The call to the model goes out "through the victim's own network connection, on their own machine." And Talos found no infrastructure owned by the attacker at all: every endpoint belongs to someone else. I wrote about [CLOSEDQUORUM](https://www.dailyferment.com/closedquorum-ai-malware-four-model-vote/) in September, the malware that put its next move to a vote among four models. Talos draws the line between the two itself, saying VOLTA shows "the same logic visible in CLOSEDQUORUM, though applied to a different phase." Its summary is one sentence I keep rereading: "Identify the step that requires the most sustained human attention and replace it with a model call." In VOLTA, that step is sorting victims. ## My first reaction: the model should have said no My first thought was about Claude. It is the default model in the code, so surely the fix is that it refuses harder. Checking that against what Talos actually found, it doesn't hold up. Talos does not say whether any model refused or answered for a real victim. What the code shows is that the author planned for refusal. The fallback, in Talos's words, pivots "to a few, smaller, and more permissive models." And VOLTA can run "without the LLM stage altogether if no key is present." The passwords, cookies and wallets are gone before any model is asked anything. A refusal from one model removes, at most, the appraisal. A refusal that is followed by the same request to a second model removes nothing. So the question I care about isn't whether one model says no. It is where a no can still count when the asker can simply go next door. ## Where a refusal still counts ![A pharmacist in a white coat reaching for a medication box on a shelf](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/11/df89-split-pharmacist.jpg) Illustrative. Photo by [National Cancer Institute](https://unsplash.com/photos/pharmacist-reaching-for-medication-on-shelf-byGTytEGjBo?ref=dailyferment.com) on [Unsplash](https://unsplash.com/photos/pharmacist-reaching-for-medication-on-shelf-byGTytEGjBo?ref=dailyferment.com) Medicine has an old name for this: doctor shopping. One doctor declines to prescribe an opioid, and the patient visits another, and then another. Each doctor's judgment can be perfect and the pattern still gets through, because no single doctor sees the other prescriptions. The fix was not to make every doctor stricter. It was to give them a shared view. Victoria in Australia launched SafeScript, a real-time prescription monitoring system, as voluntary on 1 April 2019 and mandatory a year later. It flags a patient who has received high-risk medicines from four or more prescribers within 90 days. A study in the Medical Journal of Australia this year, by Louisa Picco and colleagues, used records from 562 general practices covering about 4.7 million patients. Guess first: when Victoria first let doctors see a patient's other prescriptions in April 2019, how much did the rate of people getting monitored medicines from four or more prescribers drop right away? About **15.4%** below the predicted rate, with a further decline over the next year. Making the check mandatory in 2020 added no further step down. (Picco et al., Medical Journal of Australia, 2026.) The drop came when doctors could first see the pattern, before anyone was forced to look. Making checks mandatory added no further step down, and over time the rate drifted back up compared with the control group. The authors name "alert fatigue" as one thing still to study. That is the same problem I wrote about with [agents asking for approval so often that people stop reading](https://www.dailyferment.com/agent-approval-fatigue-what-mcp-actually-requires/). The cross: doctor shopping and model shopping #### Doctor shopping, Victoria - *Who says no:* one doctor declines a prescription - *What the asker does:* goes to the next doctor - *Who sees the pattern:* the shared monitoring system, SafeScript, from April 2019 - *Signal:* four or more prescribers in 90 days - *What happened:* 15.4% immediate drop; no extra gain from making it mandatory #### VOLTA, 2026 - *Who says no:* one model returns "I can't" or "I'm not able" - *What the asker does:* sends the same request to Kimi K2, then Gemini 2.5 Flash - *Who sees the pattern:* only the router all three calls pass through (my inference) - *Signal:* same prompt, refused, retried, from many home connections - *What happened:* unknown: Talos does not say if any model refused Sources: Picco et al., Medical Journal of Australia 2026; Medical Republic, 22 Jun 2026; Cisco Talos, 31 Oct 2026. ## Who could see VOLTA's retry? Here is where the analogy earns its place. In medicine, the monitoring sits where every prescription passes: the pharmacy and the state database. In VOLTA, every request passes through one place too. All three models are reached through a single OpenRouter endpoint. Anthropic sees a request and maybe a refusal. Moonshot sees a request. Google sees a request. None of them sees that it is the same request, rejected once and sent again. The router does. ![Diagram of VOLTA's model chain: stolen data goes from the victim's machine through one OpenRouter endpoint to Claude Opus 4.6; on a refusal the same request goes to Kimi K2, then Gemini 2.5 Flash; each lab sees only its own call, the router sees the whole chain](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/11/df89-router-chain.png) Card by Daily Ferment. Source: Cisco Talos, 31 Oct 2026. That is an inference, and it has a weak spot. A customer could swap the router for direct keys to each lab, and the shared view would be gone. It would cost them some convenience, though, and the code Talos read was built around the router. I also noticed something that cuts the other way: retrying on a second model when the first one declines is a feature ordinary developers build on purpose, for legitimate reasons. A check that treats every retry as suspicious would drown in false alarms, which is exactly where SafeScript's later numbers point. The useful signal is narrower: the same system prompt, the same refusal, the same key, arriving from many different home connections. There is a related lesson from [OpenAI's agent monitor](https://www.dailyferment.com/metr-redwood-openai-agent-monitor-coverage/): a monitor that works is still blind to traffic that never passes it. The question for any check is where it sits, before how good it is. ## If you look after Windows machines Talos's practical advice is short and none of it depends on the AI part. Block or alert on Chrome launched with --headless by anything that is not a known developer tool; VOLTA's cookie theft depends on it. Keep credentials in hardware-backed stores. If a machine is hit, try to save the file %APPDATA%\\volta\_debug.txt, which logs what was taken and whether the model call worked, then revoke tokens and change passwords. If a wallet seed phrase sat in plain text, treat the wallet as lost and move the funds to a new one made on an offline device. Established What Talos found in the code: the data VOLTA steals, the prompt, the default model, the three-model fallback that triggers on refusal phrases, the router endpoint, the builder template, no attacker-owned servers. The Victorian prescription study's numbers. Inferred That the router is the one place that sees a refused request being sent to the next model. It holds for the code Talos read; a customer could switch to direct keys and lose it. Still a guess Whether routers would act on that signal, and whether a shared check would cut model shopping the way it cut doctor shopping. Also unknown: whether any model ever refused or answered for a real victim. The claim, in one sentence When a refused request can simply be sent to the next model, a refusal only counts if someone can see the retry, and in VOLTA's design the only party placed to see it is the router in the middle. **More on Daily Ferment:** [CLOSEDQUORUM: the malware that puts its next move to a vote](https://www.dailyferment.com/closedquorum-ai-malware-four-model-vote/) and [The backdoored Claude Code extension said Anthropic. Anthropic never shipped it.](https://www.dailyferment.com/claude-code-extension-cursor-backdoor/) ## Sources - Ryan Fetterman, Cisco Talos, [Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/?ref=dailyferment.com), 31 October 2026. - Louisa Picco and colleagues, [Impact of Prescription Drug Monitoring Program Implementation on Rates and Characteristics of People Seeing Multiple Prescribers in Primary Care](https://www.mja.com.au/system/files/2026-06/mja2.70219.pdf?ref=dailyferment.com), Medical Journal of Australia 2026; 224(6): e70219, doi:10.5694/mja2.70219. - Amanda Sheppeard, Medical Republic, [SafeScript linked to sharp drop in doctor-shopping for opioids and benzos](https://www.medicalrepublic.com.au/safescript-linked-to-sharp-drop-in-doctor-shopping-for-opioids-and-benzos/126640?ref=dailyferment.com), 22 June 2026.