This new Windows malware steals all your data, then uses AI to rank how valuable you are as a victim

A new malware strain, dubbed VOLTA-AUTODOXER, is stealing vast amounts of sensitive data from unsuspecting victims before using artificial intelligence (AI) to rank the value of each target. The malicious software, identified by cybersecurity researchers from Cisco Talos through their open-source tool, CAIRN, follows four main steps in its operation: stealing data, sharing it with AI for evaluation, exfiltrating the information to attacker-controlled servers, and finally, erasing itself from the infected system.

VOLTA-AUTODOXER manages to capture an array of sensitive data, including browser passwords, cryptocurrency wallet seed phrases, session logs from popular platforms like Discord, Telegram, Steam, and Roblox, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, screenshots, device geo-location, home address, employer details, credit card information, Slack workspaces, document authorship metadata, and even an evaluation of a user's Roblox account.

Once the data is gathered, VOLTA builds a structured dossier using an AI platform, OpenRouter, where users can access various language models (LLMs) to assess the value of the stolen information. The AI, which can be programmed with different models like Claude, Kimi K2, or Gemini 2.5 Flash, determines whether the data is worth the effort, ranking the victim accordingly.

If the models fail to comply, the malware simply sends the raw data to the attacker via Telegram channel. To avoid detection, VOLTA deletes itself from the infected system, leaving behind a debug file named volta_debug.txt, which reveals the collected data and the success of the AI-powered assessment. Researchers believe that VOLTA is designed to be sold on the black market, with its modular structure allowing customers to customize the malware according to their specific needs.

To protect oneself from such threats, users are advised to revoke and rotate API keys and tokens, change passwords, and double-check crypto wallets for any suspicious activity.