Infostealer Feeds Stolen Data to Claude to Rank Victims

Cisco's Talos research group has reported a new Windows infostealer called VOLTA-AUTODOXER. After collecting everything it can from a machine, the malware sends the data to an AI model and asks it to assess the victim's "suitability as a target." The default model is Anthropic's Claude.

The malware packages the stolen data into an "evidence pack" and asks the model to list the victim's assets in order of how easily they can be turned into money. The aim is to show the operator which assets are worth pursuing.

What it steals and how it enriches the data

The malware collects browser passwords, cookies and saved payment cards, Thunderbird and Outlook mail profiles, Roblox accounts, Microsoft OAuth tokens, screenshots, and SSH and cloud provider configuration files. All saved Wi-Fi passwords are pulled in plain text. Crypto wallets are not just copied; the malware also tries to crack their vaults in place.

The real difference lies in the live enrichment performed with the stolen sessions. VOLTA searches the victim's Gmail account for Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal receipts to confirm a home address. It pulls Uber Eats and DoorDash order histories, uses a stolen Discord token to fill in profile details, and values Roblox items through Rolimons. The theft list is fairly standard for an infostealer, but this enrichment step turns passive data into something dangerous. The result is a profile containing location, home address, employer and employer domain, estimated birth year, document metadata and the last four digits of card numbers.

The AI stage and model fallback

The data is first assembled locally as Identity_Report.txt and converted to JSON, then sent with a system prompt to the model-routing service OpenRouter. The prompt tells the model to act as a "forensic intelligence analyst" and to be clear, specific and accurate. The model returns a short target assessment with sources and also reviews the victim's overall security posture, including password habits. The response is saved as AI_Analysis.txt, and both files are exfiltrated in an archive named volta_dox.zip. The model call is made over the victim's own network connection.

By default the malware uses Claude Opus 4.6, an older model released in February, with the temperature fixed at 0.2. That low value suggests the operator cares about consistent, predictable output. The author also appears to have anticipated refusals: the malware recognizes refusal phrases and inadequate responses, and in that case falls back first to Moonshot AI's Kimi K2 and then to Google's Gemini 2.5 Flash. If no OpenRouter API key is supplied, the file can still be delivered over Telegram without the AI data.

Built for resale, and what defenders can do

VOLTA appears to have been designed for resale. A template with six replaceable fields for a private Telegram channel, API keys and settings is filled in at build time. The customer supplies the values and gets a binary built just for them. The field credentials are encrypted but can be recovered from the file. If all goes to plan, the customer receives ranked target assessments in their Telegram inbox without needing any infrastructure of their own, which is why the chokepoints lie in the services the malware relies on.

Much of the token theft depends on bypassing Chrome's App-Bound Encryption by running Chrome headless. An application control policy that limits which processes can launch Chrome headless closes that decryption path. This reduces exposure to this particular VOLTA technique, but it does not stop the other theft steps, the AI stage or the exfiltration.

After an infection the main executable may delete itself, yet victims are advised to keep the volta_debug.txt log file, which shows what was collected and whether the model call succeeded. Those affected should revoke or rotate all API keys and tokens regardless of exposure, and change passwords. Funds in a wallet whose seed phrase was stored in plain text should be moved to a new wallet generated from a fresh seed, preferably created on an offline device.

The report notes that VOLTA uses AI in a relatively narrow role compared with fully AI-driven malware, and that models could take on additional stages. As AI integration matures, resilience to refusals may become a standard design requirement for malware. A Windows implant reported in September relied on a panel of four language models voting on its next move, and another reported this week can switch to the victim's own OpenAI API key. These are still cases of handing work a human analyst would do over to AI; the open question is what the next stage will be.