Malware steals everything, then asks AI what you're worth

Cisco Talos reported on October 31 that VOLTA-AUTODOXER, a self-deleting Windows infostealer, steals browser passwords, cookies and payment cards, wallet seed phrases, session tokens, cloud keys and Wi-Fi passwords, then builds a structured bundle with the victim's home address, employer, card last four digits and more.

That bundle is sent through OpenRouter to a model told to act as a forensic intelligence analyst, ranking valuables by how easily they can be monetized in a section headed “WHAT THEY'RE WORTH” and judging password hygiene under “THEIR OPSEC”. The default model is Claude Opus 4.6, falling back to Kimi K2 and then Gemini 2.5 Flash when a reply contains a refusal phrase.

Talos stresses the AI stage is optional — without a configured key the malware still steals — and it has not observed VOLTA in real attacks or given a victim count, so this is a documented design, not a confirmed campaign.