A Windows infostealer that calls itself VOLTA-AUTODOXER steals everything it can from a PC and then asks an AI model to turn the haul into a "target assessment", Cisco's Talos research organization reports, according to Tom's Hardware. The malware builds a structured "evidence bundle" on the victim and asks the model for a list of their assets ranked by how much they could be cashed out for. The prompt tells the model to act as "a forensic intelligence analyst".
VOLTA steals browser passwords, cookies and saved payment cards, email profiles, Microsoft OAuth tokens, SSH and cloud-provider configuration files and Wi-Fi passwords, and tries to crack crypto wallets. It also uses the stolen sessions to enrich the profile: it searches Gmail for receipts from Amazon, DoorDash and PayPal to confirm a home address and pulls order histories. The data goes through OpenRouter, a service that routes requests to different models, and the reply is sent to the operator over Telegram together with the stolen material.
The default model is Anthropic's Claude Opus 4.6. The malware looks for refusal phrases or thin replies and then switches to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash. Without an API key, it sends the dossier without the AI step. According to the report, VOLTA appears to be built for resale, with a template in which the customer fills in a Telegram channel, keys and settings.
Talos advises victims to keep the volta_debug.txt log, rotate all keys, tokens and passwords, and move funds from wallets whose seed phrases were stored in plain text. It is not known how many machines have been infected, and no response from Anthropic or OpenRouter has been published.