New AI-driven malware feeds stolen data to Claude to rank victims' assets

Security researchers at Cisco Talos identified a self-deleting Windows infostealer called VOLTA-AUTODOXER that automates victim profiling by querying commercial artificial intelligence models, as detailed in tomshardware.com's report. Instead of dumping raw logs onto remote command servers for manual review, the program sweeps a compromised host, aggregates personal identifiers, credentials, and financial snippets, and transmits the collection to large language models through OpenRouter. The AI prompt instructs the system to behave as a blunt forensic intelligence analyst, ranking the victim's assets by potential liquidation value so attackers know immediately what is worth exploiting.

This breakdown covers how VOLTA-AUTODOXER gathers host data, executes local enrichment using stolen sessions, orchestrates automated model failovers when safety filters trigger, and packages intelligence for operators. It examines the architectural mechanics of its headless browser bypasses, the structure of its resale template, and the operational implications for enterprise system administrators and individual users evaluating their endpoint defense posture.

New AI-driven malware feeds stolen data: what actually changed

Infostealers traditionally exfiltrate raw credential stores, session databases, and configuration archives to central command infrastructure, leaving attackers to manually sort through thousands of records or run static scripts. VOLTA-AUTODOXER changes this dynamic by moving forensic triage directly onto the victim's machine during the infection cycle. The payload aggregates data into a structured evidence bundle, serializes the information into JSON, and issues live API queries over the victim's network to generate an immediate valuation dossier.

Rather than relying entirely on human operators to identify lucrative targets, the malware uses Anthropic's Claude Opus 4.6 as its default evaluation engine, running with a fixed temperature setting of 0.2 to enforce consistent analysis. The software prompts the model to summarize the victim's overall operational security posture, check password hygiene, and calculate expected cash-out returns. If the operator omits an API key, the program bypasses the inference stage entirely and transmits raw files, demonstrating a flexible pipeline that integrates automated evaluation without creating hard operational dependencies.

New AI-driven malware feeds stolen data: how it works

The infection routine begins by harvesting browser cookies, saved payment cards, login credentials, and plaintext Wi-Fi keys, alongside Thunderbird and Outlook email profiles, Roblox credentials, and Microsoft OAuth tokens. VOLTA searches the filesystem for SSH keys and cloud configuration files, captures desktop screenshots, and attempts inline cracking against discovered cryptocurrency wallet vaults. It then executes an active enrichment stage, using stolen Gmail session cookies to scan inbox receipts from DoorDash, Uber Eats, Grubhub, Amazon, Walmart, and PayPal to confirm home addresses, while querying Rolimons to price stolen Roblox inventories.

Once compilation finishes, the tool writes the local profile to Identity_Report.txt, pairs it with an operational system prompt, and issues an HTTP POST request to OpenRouter. When Claude returns an analysis, the response is saved as AI_Analysis.txt and bundled with the identity report into an archive named volta_dox.zip before delivery to a configured Telegram channel. The binary contains automated fallback routines that inspect API returns for refusal phrases or truncated text, switching sequentially to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash if safety mechanisms reject the prompt.

New AI-driven malware feeds stolen data: why it matters now

VOLTA illustrates how threat actors are applying commercial generative AI interfaces to eliminate labor bottlenecks in data-theft operations. Attackers do not need to host specialized parsing infrastructure, maintain custom analytical databases, or run private command-and-control servers, because third-party model routers and public messaging channels handle the processing and delivery. The operational footprint remains largely confined to outbound requests directed at legitimate external services, making detection through static network filtering more challenging for standard perimeter firewalls.

The program also highlights an evolving arms race around model alignment and guardrails. By integrating programmatic fallback pathways across three separate model providers, the developer accounted for commercial content moderation policies. This modular architecture reflects a broader trend noted across recent cyber threats, including an implant discovered in September that utilized a four-model consensus panel for tactical choices, as well as separate tools designed to appropriate a victim's personal OpenAI credentials to run malicious workloads.

New AI-driven malware feeds stolen data: who is affected

The malware targets Windows desktop users, with particular exposure for individuals who store authentication tokens, cryptocurrency seed phrases, and cloud development keys across local directories. To access sensitive browser credentials, VOLTA bypasses Chrome App-Bound Encryption by executing Google Chrome in a headless state without an active graphical interface. Systems that lack process restrictions governing background browser execution remain susceptible to losing stored web sessions, saved payment records, and enterprise service tokens managed within modern web browsers.

Organizations with cloud infrastructure profiles and sensitive administrative keys stored on developer workstations face elevated risk. Because VOLTA extracts SSH keys and service-provider configuration files alongside corporate email data, a single infected endpoint provides attackers with sufficient credential depth to evaluate lateral expansion into enterprise cloud estates. Even when defensive policies prevent headless Chrome execution, the malware continues collecting local documents, system metadata, network keys, and offline cryptocurrency repositories.

New AI-driven malware feeds stolen data: what to watch

The executable is distributed as a pre-configured template containing six distinct build slots, allowing criminal customers to supply custom Telegram channel destinations, API keys, and behavioral settings prior to binary compilation. While the configuration strings within these slots are encrypted, analysts can recover the underlying credentials directly from the sample files. Defensive teams can protect against the credential harvesting stage by implementing application control policies that block arbitrary host processes from spawning Chrome in headless mode.

Victims reviewing a suspected host should locate and preserve volta_debug.txt, a local log file that remains on disk after the primary executable self-deletes. This log records which assets were gathered and confirms whether the external model inference completed successfully. Affected users must revoke all active session tokens, rotate cloud configuration keys, change system passwords, and transfer funds from compromised cryptocurrency seed phrases to new addresses generated on air-gapped hardware.