This new Windows malware steals all your data and then uses AI to classify your value as a victim
follow us
Add us as a preferred source on Google
- New malware uses AI to analyze stolen data, classify victims and identify the most profitable targets
- VOLTA-AUTODOXER steals credentials, crypto wallets, tokens and personal information before generating AI files
- Researchers warn that the malware could commodify AI-powered victim profiling for ransomware and cybercrime operators.
Stealing sensitive data from a lot of people is one thing, but determining whether that data is worth anything to anyone or not is a completely different game.
Now, it seems that cybercriminals have found a way to easily profile their victims’ information and are using (you guessed it) Artificial Intelligence (AI).
Cisco Talos cybersecurity researchers discovered a new strain of malware through the Cognitive Artificial Intelligence Research Network (CAIRN), an open source cybersecurity research kit created to identify and track AI-powered malware.
Latest videos ofTechnologyRadar
The strain is called VOLTA-AUTODOXER and its operation is divided into four key steps: 1) steal as much information as possible; 2) share it with an AI for evaluation; 3) extract the data to the infrastructure controlled by the attacker; and 4) remove yourself from the victim’s system.
Analyzing the data
Cisco Talos did not say where exactly the malware was found, how many devices it infected, or how it is spreading. He said that on a surface level, he looks like any other information thief. Gets browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud provider keys, Wi-Fi profiles and screenshots.
But this is where it departs from the industry standard, by building a structured evidence package about the person behind the system.
It extracts the device’s geolocation, home address, employer and employer domain, inferred year of birth, last 4 digits of your credit cards, Slack workspaces, document authoring metadata, iPhone backup flags, and even a live Roblox account valuation. Then switch to Gmail and look for emails from UberEats and DoorDash to confirm the home address.
VOLTA then bundles and serializes the package, before PUBLISHING it to OpenRouter, an AI infrastructure platform where users can access hundreds of LLMs through a single API.
There, the AI instructs the model to behave like a “forensic intelligence analyst writing a target assessment.” In other words, AI is tasked with evaluating whether the extracted data is worth it, and if so, how much. Victims are sorted by value, giving attackers more time to do what appears to be the ultimate goal: ransomware.
The default model is Claude, but if it refuses to comply for any reason, the malware is instructed to resort to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. If neither model ends up working, the malware will simply send raw data to the attacker. This is usually done through a Telegram channel.
fleeing
Once the job is complete, VOLTA is told to wipe itself from the system, presumably to cover its tracks. A separate file, called volta_debug.txt apparently remains on the system, showing what was collected and whether the AI-powered evaluation was successful or not.
Researchers believe VOLTA is designed to be sold on the black market. Things like the Telegram channel or API keys are not encrypted and the malware comes as a template with six interchangeable slots that are saved at build time.
“This suggests that it is a builder model: the author sells access, the client provides its values, and the builder compiles a custom binary for each request,” explains Cisco Talos. “If VOLTA is indeed marketed malware, then the AI dossier capability is not something the author invented for his own operations. It is a feature that allows a client of any level of sophistication to target victims and start receiving classified target assessments in their Telegram inbox.”
If you suspect an infection, revoke or rotate all API keys and tokens, and change all your passwords. Also, review your crypto wallets and move all funds to a new wallet with a fresh seed.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment