VOLTA-AUTODOXER Steals Windows Data, Uses AI to Rank Victims' Worth

3 articles · Updated · Fox News · Nov 9

Cisco Talos said the newly identified Windows malware steals browser passwords, payment-card data, login sessions, crypto wallets and work credentials, then uses AI to score which victims could yield the most money.
OpenRouter routes the stolen data to AI models including Anthropic's Claude, with fallback attempts to Kimi K2 and Gemini 2.5 Flash, to generate reports on "WHAT THEY'RE WORTH" and victims' security habits.
Gmail receipts, Uber Eats and DoorDash order histories, Outlook, Slack, saved Wi-Fi passwords and screenshots can help the malware infer a victim's address, employer, age and other identity clues; it can also send results through Telegram.
Cisco Talos first observed the sample on Oct. 11, 2026 and said it has not confirmed how widely the malware has spread, how it is distributed or whether criminals have already used the AI rankings in real attacks.
The malware can delete its main executable after exfiltration—potentially leaving a volta_debug.txt file behind—highlighting how AI could make info-stealing tools more useful to less-skilled criminals.