VOLTA-AUTODOXER malware harvests Windows personal data and prompts AI models to rank targets by value

Cybersecurity researchers at Cisco Talos have uncovered a new Windows infostealer called VOLTA-AUTODOXER that sweeps up victim data and feeds it to large language models to rank targets by value. The malware harvests browser credentials, payment cards, cryptocurrency wallets, Wi-Fi profiles, session tokens, and cloud keys, before assembling a structured evidence profile. Cisco Talos did not specify how many systems have been infected, where the threat was detected, or how it spreads. [1][2]

To enrich the stolen data, the malware parses Gmail messages from services like DoorDash and Uber Eats to verify home addresses, looks up document metadata, and appraises digital assets such as Roblox accounts. It packages this information and transmits it over the victim's connection to OpenRouter, prompting an AI model to evaluate target suitability like a forensic intelligence analyst. VOLTA-AUTODOXER defaults to Claude Opus 4.6 at a low 0.2 temperature, but automatically falls back to Moonshot AI's Kimi K2 or Google's Gemini 2.5 Flash if a model refuses the prompt, ultimately delivering dossiers to attackers via Telegram before deleting its primary binary. [1][2]

Cisco Talos says the program appears built for resale, using a template with six swappable configuration slots that lets operators of any skill level compile custom binaries. Security analysts caution that this design commoditizes automated target profiling for cybercriminals and ransomware operators, allowing attackers to outsource manual victim analysis to external AI platforms. [1][2]