Info-stealing malware usually takes your passwords and leaves a person to go through the loot. VOLTA-AUTODOXER, a new strain for Windows, gives that job to commercial AI models, and they tell the attacker whether you’re a target worth pursuing.
A new report from Cisco Talos researchers covers the malware, which usually goes by the shorter name VOLTA. It takes sensitive data from machines it infects and sends it to three models: Anthropic’s Claude, Google's Gemini and Moonshot AI’s Kimi. Those models judge how much money each victim could be worth. Cryptocurrency holders are one of the groups it was built to find.
When one model refuses, it tries the next
The malware connects to the models through OpenRouter, a service that offers several AI models through a single connection. Anthropic’s Claude Opus 4.6 is its first pick.
The code has a fixed backup order. If Claude fails to process a request, VOLTA tries Moonshot AI’s Kimi K2, then Google’s Gemini 2.5 Flash. Cisco Talos said the malware looks specifically for refusal responses before it switches models.
That tells you the authors expected safety filters to stop them some of the time and wrote the code to get around it. A refused request just moves down the list.
The job the models are given
After the stolen data arrives, VOLTA asks the model to estimate how much the victim is worth financially. The models can also point out valuable assets and rank them by how lucrative they might be. They can rate the strength of the victim’s cybersecurity too.
This takes the slowest work off the attacker’s plate. No one has to read thousands of stolen logs to decide which victims to go after.
Crypto wallets come first
Talos named VOLTA’s ability to extract crypto wallet information, recovery seed phrases included, as one of its most dangerous features. With a seed phrase, an attacker could potentially get into the digital assets it protects.
VOLTA can also crack cryptocurrency wallet vaults. People who store wallet credentials on their computer are exactly who this feature is meant for.
The rest of your data is on the list as well
According to Cisco Talos security researcher Ryan Fetterman, VOLTA also takes saved browser passwords, payment card details, authentication tokens and email credentials. It hijacks active Telegram, Discord, Steam and Roblox sessions.
Outlook accounts and Slack workspaces are targets too, along with any other personal or work data on the infected machine.
Email gets particular focus. VOLTA can search Gmail accounts for receipts and purchase confirmations from Amazon, PayPal, Walmart, DoorDash and Uber Eats. An attacker can use those to figure out a victim’s identity, home address, job and spending habits.
What the profile adds
A typical stealer leaves an attacker with a stack of credentials. VOLTA leaves them with the same stack and a profile of the victim, assembled from their inbox and their wallets.
Anyone can sign up for every model on its list today, and OpenRouter links to all of them. The most useful step for readers is the one VOLTA punishes hardest: keep your seed phrase and wallet vault credentials off the Windows machine you use for email and gaming.