Tech · 1 d ago
New malware feeds stolen data to AI models to rank what its victims are worth
A Windows infostealer called VOLTA-AUTODOXER takes passwords, cookies, payment cards, email profiles and crypto wallets, Cisco's Talos researchers report. It can then delete itself.
Models it tries, in order
- 1 Claude Opus 4.6
- 2 Moonshot AI's Kimi K2
- 3 Google's Gemini 2.5 Flash
It sends a profile of the victim to an AI model, Anthropic's Claude by default, and asks for their valuables ranked by how much they could be cashed out for. If the model refuses, it switches to another one.
The malware appears built for resale: a buyer fills in their own Telegram channel and API keys, then receives ranked target assessments in their inbox.
If you are infected
Victims should keep the volta_debug.txt log, rotate all API keys and tokens, and change passwords. Crypto funds whose seed phrase was stored in plain text should move to a new wallet.
