New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely
Cisco Talos says the VOLTA infostealer sends stolen victim data to Claude Opus 4.6 to rank assets by monetization value.
A new AI-driven Windows malware, named VOLTA-AUTODOXER, has been discovered by Cisco Talos research organization. This self-deleting infostealer steals sensitive data from a victim's PC and sends it to Anthropic's Claude AI model to create a target assessment. The malware builds a structured "evidence bundle" containing stolen information such as browser passwords, cookies, saved payment cards, emails, screenshots, and even SSH and cloud-provider configuration files.
It can also switch to other AI models if the primary one refuses or fails, or even opt out of using AI altogether. The stolen data undergoes enrichment with information from the victim's Gmail, order histories from e-commerce platforms, and Roblox item values. The malware then sends the compiled dossier, first to OpenRouter for AI analysis, and then to the attacker via Telegram if no API key is provided for OpenRouter.
This malware appears to be designed for resale, with customizable settings for different customers. Following infection, VOLTA may delete itself but leaves a log file, volta_debug.txt, which contains information about the stolen data and the success of the AI analysis. It is crucial for victims to revoke API keys, rotate tokens, and change passwords after infection, as well as secure any wallets with exposed seed phrases.
The integration of AI in this malware highlights the potential for future developments in malicious AI-assisted cyber threats.
Written by urgent.news from Tom's Hardware's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
