New malware uses AI to rank Windows victims by asset value
Cisco Talos researchers found VOLTA-AUTODOXER, an information stealer that sends stolen victim data to an AI model to judge how valuable each target is.
Researchers at Cisco Talos have uncovered a new information-stealing program for Windows that uses artificial intelligence to decide which victims are worth the most. The malware, named VOLTA-AUTODOXER, was discovered during an AI-threat research project. After collecting data from an infected computer, it asks an AI model to classify each victim's assets as low, medium or high value.
The program targets a broad range of personal and financial information. It steals passwords stored in web browsers, payment card details, active login sessions and data tied to cryptocurrency wallets. It also goes after Wi-Fi passwords, screenshots, and data from Outlook and Slack. The stolen material is then sent to an AI model through OpenRouter, a platform that gives access to multiple models.
The AI step is optional, and the theft does not depend on it. If the AI analysis fails, the program keeps stealing data. The model is also asked to assess the victim's security habits, including how they handle passwords. The default model is reportedly Anthropic's Claude, with fallback options Kimi K2 and Gemini 2.5 Flash. The results can be forwarded to attackers through Telegram.
To work out where a victim lives, the malware reviews receipts from Gmail, Uber Eats, DoorDash and Amazon. That information helps build a picture of the target's home location. The program can also delete its main executable file, which may make investigation harder, though it can leave behind a diagnostic file named volta_debug.txt. It runs on the victim's own internet connection and reaches out to third-party service endpoints.
The malware appears to have been built as a customizable product, although no sale has been confirmed. The first observed sample is dated October 11, 2026. Researchers do not yet know how many infections have occurred, how far the malware has spread or how it is distributed. There is also no confirmed case in which attackers selected real victims based on the AI rankings.
Security experts recommend a set of basic defenses. Users should run antivirus software, use a password manager and create unique passwords for each account. Two-factor authentication or passkeys, timely software updates and caution around unfamiliar downloads are also advised. To reduce the risk of identity theft, people can place credit freezes, use identity protection services and request removal of their data from data brokers. A further warning is never to paste commands copied from websites into PowerShell or the Run dialog.
Source: foxnews.com
19
