Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims

Live updates

1. 2h ago

   VOLTA-AUTODOXER Malware Uses AI to Rank Victims by Financial Value

   Cybersecurity researchers have identified VOLTA-AUTODOXER, a Windows infostealer that integrates large language models to profile victims and prioritize high-value targets. The malware harvests a wide array of data, including browser passwords, cryptocurrency seeds, and Gmail receipts, then feeds this information to AI models like Claude, Gemini, or Kimi to rank the assets by monetization value. After completing this custom target assessment, the payload may delete itself from the system. The malware can switch between AI models if one refuses the request or bypass the AI step entirely.

   Why it matters

   Traditional infostealers typically collect bulk data for manual sorting or sale. By automating the appraisal process through AI, attackers can instantly identify the most profitable victims for targeted exploitation. This shift represents a move toward model-driven victim prioritization in cybercrime.

   What is confirmed

   • VOLTA-AUTODOXER targets Windows systems and harvests passwords, cookies, cryptocurrency wallet seed phrases, and session data from Discord, Telegram, Steam, and Roblox.
   • The malware uses AI models including Claude, Gemini, and Kimi to rank the financial value of a victim's stolen assets.
   • Cisco Talos researcher Ryan Fetterman stated the malware builds a structured evidence bundle including home address, employer domain, and live Roblox account valuation.
   • The payload can switch AI models if one refuses the prompt or skip the AI ranking step completely.
   • The malware may delete itself after the AI-driven ranking process is complete.

   What to watch next

   • Evidence of specific monetization schemes used for the high-value targets identified by the AI
   • Identification of the threat actor group operating the VOLTA-AUTODOXER campaign
   Sources used for this update (18)

   1. www.bluesnews.com — Blue's News - All the carnage that's fit to post!
   2. www.wired.com — WIRED - The Latest in Technology, Science, Culture and Business
   3. superpowerdaily.com — AI data-center borrowers face higher costs as lenders struggle to absorb more debt
   4. WIRED — Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims
   5. Cisco Talos Blog — Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
   6. Tom's Hardware — New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely
   7. mezha.net — VOLTA malware asks Claude to rank victims’ valuables, then may delete itself
   8. Martin Cid Magazine — Volta malware raids your Gmail receipts, then asks an AI what you’re worth
   9. Unite.AI — Cisco Talos Details VOLTA Infostealer’s LLM Victim-Ranking Stage
   10. The Hacker News — New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
   11. cyberpress.org — New Infostealers Target ChatGPT and Claude Accounts, Stealing Tokens That Can Bypass Login Protections
   12. www.wired.com — Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims
   confidence 100%