AI-Driven Malware VOLTA-AUTODOXER Uses Claude to Rank Victims by Financial Value

New Windows Infostealer Leverages Large Language Models

Cisco Talos has discovered VOLTA-AUTODOXER, a sophisticated infostealer malware that represents a troubling evolution in cyberattacks. This AI-driven malware harvests extensive data from infected Windows systems, then feeds it to Anthropic Claude and other large language models to generate detailed target assessments1

1

2

2

. The self-deleting malware operates with a clear mission: identify which victims are worth exploiting based on their monetizable assets.

How VOLTA-AUTODOXER Harvests and Analyzes Stolen Data

VOLTA steals browser passwords, cookies, saved payment cards, Thunderbird and Outlook email profiles, Roblox accounts, Microsoft OAuth tokens, screenshots, SSH and cloud-provider configuration files, and cryptocurrency wallets. Every saved Wi-Fi password gets extracted in plaintext1

1

. The malware doesn't just copy cryptocurrency wallets—it attempts to crack their vaults inline. Beyond passive data collection, VOLTA engages in live enrichment using stolen session access to search Gmail receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to confirm home addresses and pull order histories2

2

.

AI Models Serve as Forensic Intelligence Analysts

The malware assembles collected information into a structured evidence bundle containing geolocation, home address, employer domain, inferred birth year, document authorship metadata, and last four digits of payment cards. This bundle gets serialized to JSON and POSTed to OpenRouter with a 240-word system prompt instructing the model to act as a forensic intelligence analyst1

1

2

2

. The prompt demands the AI be "blunt, specific, accurate" and restricts it to using only the evidence bundle as its source.

Multi-Model Architecture Ensures Refusal Resilience

VOLTA defaults to Anthropic's Claude Opus 4.6 at a temperature of 0.2, prioritizing predictable outputs over creative responses. The adversarial use of generative AI becomes evident in its fallback mechanism—if Claude refuses or provides thin replies, VOLTA automatically switches to Moonshot AI's Kimi K2, then Google Gemini 2.5 Flash1

1

. The malware checks each response for refusal phrases like "I can't" or "I'm not able" before moving to the next model2

2

. If no OpenRouter API key is provided, it can still exfiltrate the dossier via Telegram without the AI analysis step.

Target Assessment Output and Data Exfiltration

The AI analysis produces a section titled "WHAT THEY'RE WORTH" ranking valuables by monetization potential across low, medium, and high tiers. Another section called "THEIR OPSEC" assesses the victim's security posture and password hygiene2

2

. Results are saved as AI_Analysis.txt alongside Identity_Report.txt and exfiltrated in a volta_dox.zip archive. Data exfiltration happens over Telegram at three stages: immediately after the stealer runs, after the AI call, and after live enrichment2

2

. Critically, the inference call happens over the victim's own network connection.

Evidence Points to Commoditized Malware-as-a-Service

VOLTA appears designed for resale as a product. It features a template with six swappable slots for custom Telegram channels, API keys, and settings filled at build time1

1

. Customers supply values and receive custom binaries. This approach means the AI dossier capability isn't something the author invented for personal operations—it's a feature enabling customers of any sophistication level to receive ranked target assessments in their Telegram inbox without relying on attacker-owned infrastructure2

2

.

Technical Evasion and Detection Indicators

Much of VOLTA's token theft bypasses Chrome's App-Bound Encryption by launching Chrome headless without a GUI. Application-control policies limiting which processes may launch Chrome headless can block this specific attack vector, though it doesn't stop other theft mechanisms, the AI stage, or data exfiltration1

1

. After infection, the main executable may delete itself, but a volta_debug.txt log file showing what was collected and whether the LLM call succeeded should remain.

Why This Development Matters for AI Security

Cisco Talos researcher Ryan Fetterman emphasizes that VOLTA's use of AI is relatively narrow compared to what's possible with fully AI-assisted malware. The axis of AI improvement here isn't speed or scale but effort displacement—relieving operators of analytical work2

2

. Zscaler ThreatLabz notes that large language models are well-suited to examine massive amounts of data for classification or content searching, making them ideal for identifying the most valuable or sensitive data for theft2

2

. Refusal resilience may become a standard design requirement for malware as AI integration matures. Already, a Windows malware implant reported in September was built around a panel of up to four LLMs that vote on its next move1

1

. Watch for increased adversarial adoption of generative AI across threat actor workflows as they incorporate the technology to develop custom tools and maximize attack success rates.