Researchers at Cisco Talos have identified a new Windows malware strain named VOLTA-AUTODOXER that utilizes artificial intelligence to profile victims and rank stolen accounts by value. The malware collects sensitive data including saved browser passwords, payment card information, login sessions, cryptocurrency wallets, and work-related credentials. It also targets screenshots, Wi-Fi passwords, and data from applications such as Microsoft Outlook and Slack.
After gathering information, the malware attempts to build a detailed profile of the user by searching for clues regarding their location, employer, and age. According to Cisco Talos, the malware can examine Gmail receipts and food delivery orders from services like Uber Eats, DoorDash, and Grubhub, as well as purchase history from Amazon, Walmart, and PayPal to confirm a victim's physical address. It can even analyze Roblox accounts to estimate the value of virtual items.
The malware uses the OpenRouter platform to send collected data to an AI model, instructing it to act as an intelligence analyst to determine which stolen information is most profitable. If the initial model refuses the request, the malware is designed to attempt the process using Moonshot AI's Kimi K2 or Google's Gemini 2.5 Flash. This automation allows criminals to identify high-value targets without manually reviewing hundreds of stolen accounts.
Cisco Talos first observed the malware sample on October 11, 2026. While the researchers have identified the capabilities of the software, they have not yet established how many computers are infected or the full extent of its spread.
