A newly discovered and highly sophisticated Windows infostealer known as VOLTA-AUTODOXER is combining traditional credential harvesting with artificial intelligence to optimize its illicit operations. According to recent findings from Cisco’s Talos threat intelligence organization, the self-deleting malware sweeps a compromised personal computer for virtually every available piece of sensitive information, compiles the data into a structured dossier, and then queries a leading AI model—Anthropic’s Claude by default—to analyze the haul, rank the victim’s valuables, and determine which assets are worth the cybercriminals’ immediate effort.
The emergence of VOLTA-AUTODOXER marks a troubling escalation in how modern cyberthreat actors leverage generative artificial intelligence. While security researchers have increasingly warned about the potential for threat actors to use AI for automated phishing campaigns, code generation, or orchestrating complex multi-stage intrusions, this malware integrates AI directly into the exfiltration and monetization pipeline. Instead of forcing human operators to manually sift through gigabytes of stolen logs, cookies, and configuration files to find high-value targets, the malware automates the target assessment process in real time using automated API queries directed at advanced large language models.
When VOLTA-AUTODOXER executes on a target machine, it operates with carefully engineered system prompts designed to force the AI model into a specific persona. The malware instructs the language model to act as a "forensic intelligence analyst" and mandates that the output be "blunt, specific, and accurate." Once the AI receives the structured "evidence bundle" compiled by the malware, it evaluates the individual’s digital footprint and provides the operators with a prioritized list of monetizable assets, effectively functioning as an automated business consultant for cybercrime. Furthermore, the malware is resiliently coded; if its primary AI endpoint refuses to process the data or is otherwise unavailable, VOLTA-AUTODOXER has the capability to switch to alternative models or proceed independently without AI assistance.
The breadth of data harvested by VOLTA-AUTODOXER before it even reaches the AI analysis stage is extensive and touches nearly every facet of a victim’s digital life. The infostealer is designed to target core browser data, extracting saved passwords, browsing cookies, and autofill payment card information from popular web browsers. Beyond standard web credentials, the malware targets prominent communication and productivity suites, specifically sweeping Thunderbird and Outlook email profiles for sensitive correspondence and contact lists. It also gathers Microsoft OAuth tokens, which can allow attackers to maintain persistent access to enterprise and consumer cloud services without needing to re-enter a password.
Gaming and developer accounts are similarly at high risk during a VOLTA-AUTODOXER infection. The malware specifically searches for and extracts Roblox account data, a platform frequently targeted due to its vast economy of virtual items and in-game currencies. For technical users, the threat becomes even more severe. The infostealer hunts down Secure Shell (SSH) keys and cloud-provider configuration files, potentially granting the attackers lateral movement into corporate networks, remote development servers, and cloud infrastructure. Local network security is also compromised, as every saved Wi-Fi network password stored on the machine is extracted in clear plaintext, potentially exposing other devices on the same local network to secondary compromise.
In addition to credentials and configuration files, the malware gathers rich telemetry designed to build a comprehensive dossier on the victim’s physical and professional identity. It captures screenshots of the active desktop, searches for cryptocurrency wallets, and—rather than merely copying wallet files—attempts to brute-force or crack their underlying vaults inline during the execution cycle. The resulting "evidence bundle" goes far beyond basic account logins. It compiles estimated geolocation data, residential address indicators, employer names and associated corporate domains, inferred birth years derived from local files, document authorship metadata, and the last four digits of any payment cards discovered on the system.
Cisco Talos researchers emphasize that the integration of AI models into the post-exploitation phase demonstrates a significant shift in efficiency for opportunistic and targeted cyberattacks alike. By automating the valuation of stolen data, threat actors can streamline their operations, focusing their manual efforts exclusively on individuals whose digital profiles indicate high-value corporate access, significant cryptocurrency holdings, or premium financial assets. As cybersecurity defenses continue to evolve against traditional malware signatures and automated threat actors, the weaponization of generative artificial intelligence for data appraisal underscores the ongoing challenges facing defenders in the modern threat landscape.
