Cybersecurity researchers discovered a Windows infostealer called Volta-Autodoxer that uses commercial artificial intelligence models, including Anthropic’s Claude and Google’s Gemini, to automatically analyze stolen credentials, organize logs into structured dossiers, and rank victims by their financial monetization value.
Modern credential-harvesting malware has long relied on brute-force extraction, sweeping through infected machines to siphon browser passwords, payment card details, and cryptocurrency wallet keys in a wide-net data grab. Once the data leaves the target machine, criminal operators typically face a labor-intensive sorting phase, manually sifting through raw text files and logs to figure out which compromised accounts hold real financial value. A new Windows infostealer tracked as VOLTA-AUTODOXER automates that entire analytical bottleneck by handing the stolen loot directly to large language models.
Cisco Talos Discovers the AI-Integration Layer in Volta
The malware surfaced through research conducted by Cisco Talos, which published an analysis of the self-deleting binary on October 31, 2026. Ryan Fetterman, a security researcher at Cisco Talos, noted that while the malware acts as a mature stealer that sweeps up browser credentials, OAuth tokens, and active application sessions, its defining characteristic is the way it treats the extracted data.
VOLTA, a new Windows infostealer, just started using Claude, Gemini and Kimi to rank stolen data by value. Here's what you need to know.Cisco Talos published the findings. The malware calls itself VOLTA-AUTODOXER. It is a self-deleting Windows infostealer that steals passwords,… https://t.co/pFjuDqNx00 pic.twitter.com/98MXLgbm1Z
— https://x.com/AGTPinsights/status/2117202477317517763
VOLTA is pretty mature as a stealer. It casts a pretty wide net for what it collects. It compiles all of those things together, ultimately producing a serialized dossier that it can send to a couple LLM models. It’s asking the model to act like an intelligence analyst and produce structured citation-backed assessment of the victim. It’s like a prioritization and analysis function.
Ryan Fetterman, security researcher at Cisco Talos
Talos flagged the tool utilizing its CAIRN research framework, which is built specifically to identify hacking tools incorporating AI capabilities. The analyzed binary carries a PE timestamp of August 17, 2026, and was first observed in the wild at 12:46 UTC on October 11, 2026.
Live Gmail Scraping and Roblox Valuations Feed the Evidence Bundle
Before any artificial intelligence processing begins, the malware executes an extensive local sweep of the compromised Windows computer. Alongside standard credential harvesting, VOLTA attempts to crack cryptocurrency wallet vaults inline rather than merely copying them, while also targeting plaintext Wi-Fi profiles, SSH keys, and session cookies for Discord, Telegram, Steam, and Roblox.
The system then initiates a secondary deep-dive phase using authenticated tokens discovered in the first pass. Security analysts detailed how the malware accesses the victim’s Gmail inbox to extract purchase confirmations and receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal. These receipts corroborate the target’s physical home address, employment domain, inferred birth year, and spending habits.
Active platform sessions undergo similar automated enrichment. The malware reuses stolen Discord tokens to flesh out user profiles, pulls active food-delivery order histories, and performs live lookups on Rolimons.com to price virtual Roblox inventories. All of these disparate data points compile locally into a structured JSON evidence bundle.
OpenRouter Integration and Cascading Model Fallbacks
Once assembled, the evidence bundle connects to OpenRouter, a unified API gateway that routes prompts to commercial AI models. The malware defaults its requests to Anthropic’s Claude Opus 4.6, operating at a hardcoded low temperature of 0.2 to prioritize predictable and consistent analytical output.
Anticipating that model guardrails might block requests containing illicit credential logs, the authors built a resilient multi-model fallback architecture. If the primary model refuses to process the target assessment, the malware scans the response for specific rejection language.
VOLTA uses a multi-model architecture to fall back resiliently if it hits a model’s refusal, checking each response for phrases like ‘I can’t’ or ‘I’m not able,’ before passing on to a chain of up to three models.
Cisco Talos, threat intelligence unit
When Claude Opus refuses or returns a thin reply, VOLTA automatically cascades its queries to Moonshot AI’s Kimi K2, and subsequently to Google’s Gemini 2.5 Flash. If an infected machine contains no configured OpenRouter API key, the malware can still complete its primary collection sweep and transmit the stolen logs over Telegram without generating the AI dossier.
System Prompt Instructions and the Automated Target Dossier
The core instructions governing the AI analysis are embedded within a system prompt approximately 240 words in length. The text directs the language model to adopt a specific operational stance while reviewing the harvested personal records.
The bundle is the ONLY permissible source of facts; your training knowledge must never supply a fact about the subject.
System prompt instructions, via Cisco Talos
The prompt specifically commands the model to act as a forensic intelligence analyst drafting a target assessment.
The final generated output saves locally as an analysis text file before being compressed alongside the raw logs and exfiltrated directly to the operator’s Telegram inbox. According to technical breakdowns, the required output format strictly divides the assessment into designated categories.
- A section titled WHAT THEY’RE WORTH ranking compromised assets by monetization potential across low, medium, and high tiers.
- A section titled THEIR OPSEC containing an evaluation of the victim’s overall security posture and password hygiene.
Security researchers noted that VOLTA relies entirely on template-based building, featuring six swappable configuration slots for custom Telegram channels and API keys. Rather than operating as a personal tool for a single hacker, the malware structure indicates a commercial builder model where buyers purchase customized binaries to receive automated victim dossiers directly on their devices.