AI-Driven Windows Infostealer VOLTA-AUTODOXER Ranks Victims' Assets Using Claude

Cisco Talos reports a self-deleting Windows infostealer called VOLTA-AUTODOXER that steals a wide range of data from a victim's PC, enriches it, and asks an AI model, Anthropic's Claude by default, to rank the victim's assets by cash-out value. The malware can switch to other models if one refuses, or skip the AI step entirely. It then deletes its main executable after infection, while a debug log may remain.

What the malware steals

VOLTA steals browser passwords, cookies, and saved payment cards, along with Thunderbird and Outlook email profiles, Roblox accounts, Microsoft OAuth tokens, screenshots, and SSH and cloud-provider configuration files. It also pulls every saved Wi-Fi password in plaintext. When cryptocurrency wallets are present, it attempts to crack their vaults inline rather than only copying them.

Building the target profile

The malware builds an evidence bundle containing geolocation and home address, employer and employer domain, inferred birth year, document authorship metadata, and the last four digits of payment cards. It also performs live enrichment using stolen sessions: it searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to confirm a home address, pulls Uber Eats and DoorDash order histories, reuses a stolen Discord token to fill in the victim's profile, and values Roblox items through Rolimons. The theft list is relatively standard for a stealer, but this enrichment pass turns passive data into something dangerous.

AI assessment and exfiltration

Locally, the data is assembled as Identity_Report.txt and serialized to JSON, then POSTed to OpenRouter with a system prompt. The model is asked for a concise assessment of the victim's suitability as a target, backed by citations, including an opsec analysis of overall security posture and password hygiene. Any reply is saved as AI_Analysis.txt, and both files are exfiltrated together in a volta_dox.zip archive over the victim's own network connection. By default, VOLTA uses Anthropic's Claude Opus 4.6, an older model released in February, at a temperature of 0.2. It looks for refusal phrases and thin replies, then switches in order to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash. If no OpenRouter API key is supplied, it can send the dossier over Telegram without the AI data.

Resale design, defenses, and cleanup

VOLTA appears designed for resale, using a template with six swappable slots for a custom Telegram channel, API keys, and settings that are filled at build time. Slot credentials are encrypted but can be recovered from the file. The customer receives ranked target assessments in their Telegram inbox without relying on attacker-owned infrastructure, and the chokepoints are on the services. Much token theft relies on bypassing Chrome's App-Bound Encryption by launching Chrome headless; an application-control policy that limits which processes may launch Chrome headless blocks that path, though it does not stop other theft, the AI stage, or exfiltration. The report also notes that VOLTA's AI use is relatively narrow compared with fully AI-assisted malware, and refusal resilience may become a standard design requirement. Earlier examples include a September Windows implant built around up to four LLMs voting on its next move and another reported this week that can fall back to the victim's own OpenAI API key. After infection, a volta_debug.txt log may remain and show what was collected and whether the LLM call succeeded. Victims should revoke or rotate all API keys and tokens and change passwords regardless of exposure, and move funds from any wallet whose seed phrase was stored in plaintext to a new wallet with a fresh seed, preferably generated on an air-gapped device.

Sources: Tom's Hardware