Cisco Talos finds malware that uses AI to rank victims’ stolen assets

Stolen passwords are only the starting point for a malware strain identified by Cisco Talos. Volta-Autodoxer assembles personal information into a dossier, then asks an AI model to assess the victim’s assets and security. The finding reveals software designed to hand attackers not just stolen data, but an organized assessment of what might be worth exploiting.

Talos published its analysis on October 31. There is an important boundary around the finding: researcher Ryan Fetterman told WIRED that Talos had not tracked whether Volta had been used in the wild. This is an analysis of the malware’s design, not a confirmed account of attacks against victims.

Receipts become part of the dossier

Volta is a Windows infostealer—malware built to collect sensitive information from an infected computer. Its initial sweep includes browser passwords, cookies, saved payment cards, cryptocurrency wallet seed phrases and Microsoft account tokens. It also collects sessions for Discord, Telegram, Steam and Roblox, alongside SSH and cloud-provider keys.

The next pass uses stolen account access to fill in details about the person. Volta searches Gmail receipts to establish a home address, retrieves Uber Eats and DoorDash order histories, and gathers additional Discord profile information. It also checks Roblox inventory values through the Rolimons service. These steps turn account access into a more detailed personal profile before any AI analysis begins.

The malware saves the assembled information locally as Identity_Report.txt and sends a structured bundle to OpenRouter, a service that routes requests to AI models. The model’s assignment is to interpret that evidence, rather than perform the initial collection. Its instructions ask for connections across fields, such as links between personal details and password patterns.

The requested output includes a section called “WHAT THEY'RE WORTH,” ranking assets by their potential to make money, and “THEIR OPSEC,” assessing security practices and password hygiene. The prompt asks for citations back to the supplied evidence. The resulting AI_Analysis.txt travels out with the collected dossier in a ZIP archive.

The prompt is pretty carefully crafted not to imply anything overtly malicious

Ryan Fetterman, Cisco Talos security researcher, speaking to WIRED

A refusal triggers another model

Volta defaults to Anthropic’s Claude Opus 4.6. It checks responses for refusal phrases, including “I can’t” and “I’m not able,” and can fall back to Moonshot AI’s Kimi K2, then Google’s Gemini 2.5 Flash. Talos interprets that chain as deliberate preparation for encountering model safeguards—not evidence that every named model accepted the requests.

The AI stage is optional: the underlying stealer can still operate without it. Talos also found build-time settings that let someone substitute credentials and configuration values. Fetterman says this suggests a product intended for multiple buyers, rather than a tool made solely for one operator’s campaigns. That possible sales model remains an inference from the code.

Defending against the theft, not just the AI

Talos’s defensive advice targets the collection stage. Much of Volta’s token theft relies on bypassing Chrome’s App-Bound Encryption, a protection for stored browser data. Talos recommends restricting which processes can launch Chrome in headless mode, which runs without its usual visible interface, or alerting on unexpected launches.

If a compromise is suspected, Talos recommends:

• Preserve volta_debug.txt if available. Although the malware can delete itself, this timestamped log records what it collected and whether the AI call succeeded.
• Revoke potentially compromised account tokens and change passwords. Treat a cryptocurrency wallet as fully compromised if its seed phrase was stored in plain text on the computer.