AI-powered infostealer picks out the most profitable parts of your stolen data
A new Windows infostealer sends the data it steals to an AI model and asks it to rank the victim’s assets by how much money they could bring in, Cisco Talos has found.
“There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics,” said Ryan Fetterman, a security researcher at Cisco.
The malware calls itself VOLTA-AUTODOXER and turned up through Talos’ CAIRN research effort, which tracks malware that uses AI. It deletes itself after running, and every endpoint it talks to belongs to a third party, so there is no attacker-owned infrastructure to go after.
At first, VOLTA behaves like any other infostealer. It grabs browser passwords, cookies and saved payment cards, cryptocurrency wallet seed phrases, Microsoft OAuth tokens, SSH and cloud provider keys, screenshots, and sessions for Discord, Telegram, Steam and Roblox. It also dumps the password of every Wi-Fi network saved on the computer in plaintext and runs a built-in cracker against cryptocurrency wallet vaults.
“VOLTA builds a structured evidence bundle about the person behind the machine,” Fetterman noted. “This bundle contains geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation.”
“It then uses stolen session access to enrich that bundle further: searching the victim’s Gmail for purchase receipts to corroborate a home address, pulling UberEats and DoorDash order history, and enriching Discord accounts via the stolen token,” Fetterman added.
A target assessment on demand
The finished bundle is sent to the OpenRouter API with instructions telling the model to play a forensic intelligence analyst drafting a target assessment of the victim.
The model has to rank the victim’s valuables by how easily they can be turned into money, tag each one low, medium or high, and then judge the victim’s security habits and password hygiene. The instructions also tell it to look for links between scattered details, such as a person’s name, address or university, and the passwords they pick.
The model’s job, Fetterman explained, is to stretch the stolen data and draw inferences that add to its value.
“After the collection and enrichment stages are complete, the data is assembled and structured locally in a file called ‘Identity_Report.txt’. This file is serialized into a bundle as JSON and POSTed to OpenRouter along with the system prompt. The returned payload is received as ‘AI_Analysis.txt’. Both files exfil together in ‘volta_dox.zip’,” he wrote.
By default, VOLTA sends its request to Anthropic’s Claude Opus 4.6. Each reply is checked for wording that signals a refusal, and if the model declines, the job passes to Moonshot AI’s Kimi K2 and then to Google’s Gemini 2.5 Flash.
“This multi-model architecture suggests that the operator is anticipating encountering refusals, with the fallback pivoting to a few, smaller, and more permissive models,” he observed.
Built for buyers
The malware’s settings, including its Telegram channel and API keys, go into six slots in a template that is filled in when the binary is built.
“This suggests it’s a builder model: The author sells access, the customer provides their values, and the builder compiles a custom binary for each order. The credentials in those slots are encrypted, but not in a meaningful way,” Fetterman stated.
If VOLTA is sold this way, buyers with any level of skill can aim it at victims and get ranked target assessments delivered to their Telegram inbox.
Handing the legwork to AI
Researchers describe VOLTA as a mature stealer with an AI layer added to take the analysis work off the operator’s hands. Talos saw the same approach in the CLOSEDQUORUM implant, applied to a different phase of an attack, where the step that demands the most human attention is also handed to a model.
“These implants reflect the same underlying logic: Identify the step that requires the most sustained human attention and replace it with a model call. The question for defenders is not whether this pattern will appear elsewhere, but which phase it touches next,” Fetterman concluded.
