Researchers have discovered a new strain of malware, VOLTA-AUTODOXER, which uses artificial intelligence to analyze stolen data and rank victims based on their potential financial value to criminals.
In an alarming development in the realm of cybersecurity, researchers have unveiled a new strain of malware known as VOLTA-AUTODOXER. This sophisticated software employs artificial intelligence (AI) to analyze stolen data and assess the potential value of its victims, enabling cybercriminals to target the most lucrative accounts.
Traditionally, hackers have sought to obtain passwords, credit card details, and other personal information. However, VOLTA-AUTODOXER takes this a step further by creating detailed profiles of individuals based on the information it steals. The malware not only collects sensitive data but also evaluates it to help criminals determine which victims warrant further attention.
The discovery of VOLTA-AUTODOXER was made by researchers at Cisco Talos, who were investigating AI-powered threats in a cybersecurity research project. The malware operates by infiltrating a victim’s computer, gathering sensitive information, and then utilizing AI to analyze and rank that information according to its potential value.
Once installed, VOLTA-AUTODOXER can extract a wide array of data, including saved browser passwords, payment card information, and login sessions. It specifically targets cryptocurrency wallets and work-related credentials, compiling a comprehensive report on the user that includes their location, employer, and even clues about their age.
One particularly concerning aspect of this malware is its ability to collect data from various applications, such as Microsoft Outlook and Slack, as well as saved Wi-Fi passwords and screenshots. Researchers have noted that VOLTA-AUTODOXER can even attempt to crack cryptocurrency wallet vaults, further increasing its potential for harm.
The AI component of VOLTA-AUTODOXER is particularly noteworthy. After gathering information, the malware sends it to an AI model via a platform called OpenRouter. This model acts as an intelligence analyst, determining which pieces of stolen information could be the most valuable. This means that instead of manually sifting through hundreds of stolen accounts, criminals can leverage AI to identify high-value targets more efficiently.
Moreover, VOLTA-AUTODOXER can search for personal clues, such as home addresses and financial information, by examining receipts from services like Uber Eats and DoorDash. By accessing Gmail accounts, the malware can retrieve order histories and other personal data, allowing criminals to connect online activity with real-world identities.
The most troubling feature of VOLTA-AUTODOXER is its ability to generate a report that ranks victims based on their potential worth. This report includes sections labeled “WHAT THEY’RE WORTH,” which assigns low, medium, or high rankings to valuable information, and “THEIR OPSEC,” which assesses the victim’s security habits. This functionality indicates that the malware is designed to provide criminals with a clear understanding of the potential gains and the effectiveness of a victim’s security measures.
Cisco Talos has identified that VOLTA-AUTODOXER primarily uses Anthropic’s Claude as its default AI model. However, if this model declines to assist, the malware can switch to alternatives like Moonshot AI’s Kimi K2 or Google’s Gemini 2.5 Flash. This fallback mechanism suggests that the malware’s developers anticipated potential refusals from AI models and created a system to circumvent such issues.
After completing its tasks, VOLTA-AUTODOXER can remove its main executable, complicating investigations into infections. However, it may leave behind a diagnostic file, volta_debug.txt, which could provide valuable insights for security analysts regarding the information collected and the success of the AI analysis.
Interestingly, the malware uses the infected computer’s internet connection to communicate with the AI service, making its activities less conspicuous. Researchers have also found indications that VOLTA-AUTODOXER was designed as a customizable product, potentially allowing different criminals to tailor it to their needs. While there is no confirmed evidence that this malware is currently being sold, its capabilities raise concerns about the accessibility of AI-powered victim profiling for less technically skilled criminals.
Despite the alarming features of VOLTA-AUTODOXER, researchers have not yet determined how widely it has spread or how many computers it has infected. The malware was first observed on October 11, 2026, but no specific distribution campaigns have been identified. This uncertainty underscores the importance of general cybersecurity measures to protect against information-stealing malware.
To safeguard against threats like VOLTA-AUTODOXER, users should implement strong antivirus software to detect and block malicious downloads and suspicious programs. Regular updates and scans are essential for maintaining security. Utilizing a reputable password manager can also help protect stored credentials, while enabling two-factor authentication (2FA) adds an additional layer of security to important accounts.
It is crucial to keep operating systems and browsers updated to close vulnerabilities that could be exploited by malware. Users should exercise caution when downloading software from unfamiliar sources and avoid clicking on suspicious links or attachments.
For those concerned about their personal information being collected, consider using a personal data removal service to limit the amount of information available to data brokers. Additionally, identity theft protection services can monitor for signs of misuse and alert users to suspicious activity.
As cybercriminals continue to evolve their tactics, the emergence of VOLTA-AUTODOXER highlights the need for individuals to take proactive steps to protect their personal information. The ability of this malware to leverage AI for victim profiling raises significant concerns about the future of cybercrime and the potential for increased targeting of individuals.
In conclusion, the capabilities of VOLTA-AUTODOXER serve as a stark reminder of the importance of cybersecurity. As criminals become more sophisticated, individuals must remain vigilant in protecting their personal information and take the necessary precautions to safeguard against potential threats, according to Cisco Talos.