This malware steals your passwords, then asks Claude how much you're worth

Infostealers have always had a sorting problem. A criminal who infects ten thousand Windows machines ends up with ten thousand folders full of passwords, cookies and crypto wallets, and most of them are worth almost nothing. Somebody has to dig through the pile to find the person with a fat brokerage account and bad password habits. That digging takes time, and time is the thing low-rent crooks don't want to spend.

A new stealer found by Cisco Talos hands the digging to an AI model. Talos calls it VOLTA-AUTODOXER, or VOLTA for short. Researcher Ryan Fetterman published the analysis on October 31. The sample was first seen on October 11.

Grab everything, then ask for an appraisal

The theft part is thorough and fairly standard. According to Talos's write-up, as summarized by Unite.AI, VOLTA grabs browser passwords, cookies and saved payment cards from Chromium browsers, plus Firefox and Thunderbird data. It takes tokens for Outlook, Slack, Discord, Telegram, Steam, Battle.net, Roblox and Microsoft accounts. It copies SSH keys, Google Cloud and VPN configs, saved Wi-Fi passwords and screenshots. If it finds a crypto wallet vault, it tries to crack it on the spot.

Then it gets nosy. VOLTA uses the stolen sessions to log into the victim's Gmail and search for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal, which lets it confirm a home address. It pulls food delivery history. It values the victim's Roblox inventory with a live lookup. Everything goes into a structured report with fields for location, employer, inferred age and partial card numbers.

That report is what Talos calls the evidence bundle, and it goes to an AI model through OpenRouter, a service that resells access to many models behind one API. The system prompt casts the model as "a forensic intelligence analyst drafting a target assessment." It asks for the victim's assets ranked by how much they could be cashed out for, along with what Talos describes as "an assessment of the victim's security posture and password hygiene." Talos says the prompt pushes the model to infer things the stolen data doesn't actually show.

The default model is Anthropic's Claude Opus 4.6. The malware scans the response for refusal phrases. If Claude declines, VOLTA tries Moonshot AI's Kimi K2, then Google's Gemini 2.5 Flash. In Talos's words: "VOLTA uses a multi-model architecture to fall back resiliently if it hits a model's refusal." If there's no API key at all, it skips the AI step and ships the raw dossier anyway.

Crime as a build order

The business model is the part worth sitting with. Talos found the binary is compiled from a template with six slots filled in at build time, including a Telegram channel and the API keys. "The author sells access, the customer provides their values, and the builder compiles a custom binary for each order," Talos writes. The customer then gets to "start receiving ranked target assessments in their Telegram inbox."

The slot encryption is weak, Talos adds, since the key comes from constants inside the binary itself. Whoever wrote VOLTA put real work into the stealing and the AI pipeline, and much less into hiding it.

There's a sneaky detail in where the AI call happens. The request to the model goes out from the victim's own machine, over the victim's own network. Talos notes that every endpoint it observed was "third-party controlled, with no attacker-owned infrastructure." So the victim's computer pays for its own appraisal, and the traffic looks like one more app talking to an AI service, which is ordinary traffic on plenty of office networks now.

Data leaves in up to three staged archives: one after the credential grab, one after the AI call, and one if the Gmail and delivery-app digging turned anything up. Then the stealer deletes itself.

Talos is careful about what the AI does and doesn't add. It isn't making the theft faster or bigger. "The axis of AI improvement here is not speed or scale but effort displacement," the researchers write. The model does the triage a human operator used to do by hand, which means a buyer with no skill at all can point the kit at a list of victims and get back a ranked shopping list.

The fallback chain is what should worry the AI labs. Safety training on a single model is a speed bump if the malware can just ask the next model down the list. "As AI integration in malware matures, refusal resilience may become a standard design requirement," Talos writes. In plain terms: the crooks have already built for the refusal, and Claude saying no is now a line in somebody's error handling.

Talos's advice for defenders is concrete. Use application control to restrict which processes can launch headless Chrome, which VOLTA abuses to get around Chrome's App-Bound Encryption. Use hardware-backed credential storage. If you're hit, keep the volta_debug.txt log the malware writes to %APPDATA%, revoke every token and change every password. And if a crypto seed phrase was sitting on that machine in plain text, treat that wallet as already gone.

Sources: Cisco Talos, Tom's Hardware, Unite.AI.