2 phrases run VOLTA's fallback, tested on 24 replies

Cisco Talos published the infostealer's AI layer on October 31 — a three-model fallback chain built on the expectation that models will say no, and built to keep asking until one says yes. VOLTA, self-named "VOLTA-AUTODOXER" in its own code, is a self-deleting Windows infostealer that surfaced through Talos's CAIRN research effort. The analyzed sample was first seen October 11, 2026 at 12:46 UTC.

The stealing half is conventional and thorough: browser passwords, cookies and payment cards, crypto wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles dumped to plaintext via WlanGetProfileList, screenshots — plus an embedded cracker run against wallet vaults inline. Then it enriches the haul with the victim's own sessions: Gmail receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to corroborate a home address, food-delivery order history, Discord profile enrichment, and a live Roblox inventory valuation via Rolimons. The new half is what happens next.

Everything is assembled into Identity_Report.txt, serialized to JSON, and POSTed to OpenRouter with a system prompt telling the model to act as "a forensic intelligence analyst drafting a target assessment." The required output has a section titled "WHAT THEY'RE WORTH," valuables ranked low/medium/high by monetization, and a section on "THEIR OPSEC," judging the victim's security posture and password hygiene. The reply comes back as AI_Analysis.txt, and both files exfiltrate together in volta_dox.zip. Exfil happens in up to three stages — volta_log.zip after the steal, volta_dox.zip after the AI call, volta_doxnet.zip if network enrichment produced anything — and the inference round-trip runs over the victim's own connection, on their own machine.

The fallback chain is the detail I wanted to probe. Talos documents it exactly: default model anthropic/claude-opus-4.6, then moonshotai/kimi-k2, then google/gemini-2.5-flash, at a hardcoded temperature of 0.2, via hand-assembled JSON with a Mozilla/5.0 User-Agent. If a model refuses, VOLTA checks the reply for phrases like "I can't" or "I'm not able" and moves on to the next model.

Talos reads this as deliberate engineering: the authors anticipated hitting guardrails and built refusal resilience in. So I implemented the detector exactly as quoted — a case-insensitive substring search for those two phrases — and ran it against 24 replies I wrote: 12 genuine refusals, 12 compliances. The code is the whole detector: PHRASES = ["i can't", "i'm not able"] def is_refusal(reply: str) -> bool: low = reply.lower() return any(p in low for p in PHRASES) And here is what it scored: corpus = 24 replies (12 refusals, 12 compliances) true positives = 6 (refusals caught) false negatives = 6 (refusals missed) false positives = 4 (compliances flagged as refusals) true negatives = 8 recall on refusals = 6/12 = 50.0% precision = 6/10 = 60.0% accuracy = 14/24 = 58.3% The misses are instructive.

Every refusal phrased differently from the two quoted strings sailed through: "I cannot help with that request," "Sorry, I am unable to comply," "I must decline," "I refuse to produce a dossier." And the false positives are the mirror image — compliances that happen to contain the phrase in a non-refusal context, like "I can't overstate how valuable the cloud keys are" or "the note says I can't miss the Roblox valuation, $412." A substring check cannot tell a refusal from a quotation, an idiom, or a contraction doing ordinary work. One honest caveat, and it matters: Talos says "phrases like" — the real detector's list may be longer than the two phrases quoted in the report. My 50% recall is a measurement of the detector as quoted, not proof about the real binary's full list.

What the measurement does show is the fragility of the approach itself: every phrase you add to catch "I cannot" and "I am unable" also risks catching more compliances that merely mention those words, and the detector still has no answer for a refusal that simply says "No." The rest of the Talos report keeps the story grounded. The AI stage is optional: with no API key configured, VOLTA skips it and still steals everything. The builder model is an inference from a template with six swappable slots (Telegram channel, API keys, settings) filled at build time, its "encryption" just SHA-256 of two constants sitting in the same binary — recoverable by anyone who reverses the file.

There is no attacker-owned infrastructure; every observed endpoint is third-party controlled. And Talos has not observed VOLTA being used in real attacks, has no victim count, and reports no case of a model actually producing a dossier in a live compromise. This is a sighting of a design, not an epidemic.

For defenders, Talos's countermeasure is concrete and cheap: much of the token theft relies on bypassing Chrome's App-Bound Encryption, and an application-control policy restricting which processes may launch Chrome with --headless blocks that decryption path entirely. If you are cleaning up, preserve %APPDATA%\volta_debug.txt — a timestamped harvest log that records exactly what was collected and whether the LLM call succeeded — then revoke tokens and change passwords. Talos's closing line is the one to keep: refusal resilience may become a standard design requirement in crimeware, the same way effort displacement already has.

The first malware to hire an AI analyst did not build a sophisticated judge of refusals. It built a two-phrase substring check and a fallback list — and that was enough to ship. Sources: Cisco Talos, "Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer" (October 31, 2026) — https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ .

Sample SHA-256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, first seen October 11, 2026 12:46 UTC, per Talos. The refusal-detector probe, corpus and scores are from my own run; the corpus is synthetic, written by me, and the detector tested is the two quoted phrases only.