🔍 Read the full analysis: When Malware Asks AI About You: The VOLTA Infostealer Story on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cisco Talos reported that a Windows infostealer called VOLTA-AUTODOXER can send stolen data and victim profiles to AI models through OpenRouter, with Claude Opus 4.6 set as its default. Talos analyzed one sample and did not establish whether any model generated a target assessment or how many people were affected.
Cisco Talos reported Oct. 31 that a Windows infostealer called VOLTA-AUTODOXER can send stolen information and a profile of its victim to AI models, asking for a “target assessment.” The malware’s settings name Anthropic’s Claude Opus 4.6 as the default model, but Talos did not establish whether Claude or another model generated an assessment.
In its report, “Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer,” Talos researcher Ryan Fetterman described a program that collects data from browsers, accounts and files on a Windows computer. The report says the stolen material can include passwords, browser cookies and saved payment cards, as well as sessions for services such as Discord, Telegram, Steam and Roblox. It also lists Microsoft sign-in tokens, email profiles, SSH and cloud configuration files, Wi-Fi passwords, screenshots and cryptocurrency wallets.
Talos says VOLTA goes beyond collecting files by using stolen sessions to gather information from online accounts. Its report describes searches for purchase receipts and food-delivery histories, along with checks of a victim’s online profiles. The malware then compiles a victim profile that may include location and address details, employer information, payment-card digits and workplace services. These are capabilities Talos attributed to the analyzed sample, not evidence that every listed item was recovered from a victim.
The profile is saved locally, converted into structured data and sent to OpenRouter, a service that provides access to multiple AI models. Talos says the malware’s prompt asks the model to act as a forensic intelligence analyst and draft an assessment, including a section titled “WHAT THEY’RE WORTH.” The settings name Claude Opus 4.6 as the default, followed by Moonshot’s Kimi K2 and Google’s Gemini 2.5 Flash if the preceding model refuses. Without an API key, the AI step is skipped, but the report says the stolen data can still be sent to the operator through Telegram.
Infographic 01 · How VOLTA works
A stealer that hands the sorting to an AI
What Cisco Talos describes, step by step, at the level defenders need. First seen 11 Oct 2026; Talos believes it is sold as a kit.
- StealPasswords, cookies, cards, chat and gaming sessions, sign-in tokens, SSH and cloud files, Wi-Fi passwords, wallets
- EnrichUses stolen sessions to confirm a home address and fill in the profile
- Ask a modelSends the profile to a model router for a “target assessment”
- Send outStolen data and any AI report go to the buyer over Telegram
- VanishThe main program may delete itself
- 1st choiceAnthropic Claude Opus 4.6
- If it refusesMoonshot Kimi K2
- If that refusesGoogle Gemini 2.5 Flash
- No API key?Skip the AI, send the raw data anyway
Required sections of the report: “WHAT THEY’RE WORTH” and “THEIR OPSEC”.
- Whether Claude, or any model, actually wrote a dossier.
- How many victims there are. Talos analysed one sample.
- How VOLTA reaches victims.
- Whether Anthropic or OpenRouter were notified.
Source: Cisco Talos, 31 Oct 2026. Simplified for readers; no hashes, prompts or attack details reproduced.
Powered by Thorsten Meyer AI
AI Adds a Victim-Assessment Step
The report describes a change in how stolen data may be handled: instead of relying entirely on an operator to sort through a large collection, malware can ask a model to help summarize and rank information. Talos calls this “effort displacement”—using a model to take on a time-consuming part of criminal work. That description is the researchers’ interpretation of the sample’s design, not proof that the approach has produced successful attacks at scale.
For people and organizations, the potential risk is not limited to passwords. A profile assembled from account histories and local files could give an operator context for deciding which accounts, assets or personal details to pursue. But the available findings do not show that the model produced usable intelligence, or that any particular person was targeted because of an AI-generated assessment. The confirmed development is that the malware contains a path for submitting the data to AI services.
The model connection also raises practical monitoring questions. Organizations may be able to spot unexpected AI API traffic from ordinary desktop computers, especially when it comes from programs that have no business using those services. That would not, by itself, prove a device is infected, but it could provide a reason to investigate alongside other security alerts.
Popular right now
Samsung 75-Inch M80H Series Mini LED 4K Smart TV (2026)
Jura E6 Automatic Espresso Machine, Piano Black (15622)
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Dried Rose (KSM150PS)
As an affiliate, we earn on qualifying purchases.
What Talos Found in VOLTA
Talos said it found the sample through CAIRN, its project for hunting malware that incorporates AI. The researchers reported analyzing one sample, first seen on Oct. 11, 2026. The report appeared on Oct. 31; WIRED reported on it the same day, and Tom’s Hardware followed on Nov. 1, according to the supplied source material.
The malware’s AI request is one part of a broader theft process. Talos describes data collection from browsers, messaging and gaming accounts, email, work-related configuration files and cryptocurrency wallets, followed by attempts to build a more detailed picture of the person behind those accounts. The model call is routed through OpenRouter rather than being described as a direct connection to an AI provider.
A separate development reported in the source material concerns Anthropic’s text watermarking. An Anthropic customer email, as reported by Mashable and The Decoder, said that from Nov. 3, text from Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6 would carry an invisible watermark. The reporting says the watermark is intended to label text in some use cases; it does not prevent a model from being used in a request like the one Talos describes. The watermark rollout is related background, not a control shown to have stopped VOLTA.
““effort displacement””
— Cisco Talos, in its report on VOLTA-AUTODOXER
What the Sample Cannot Prove
Talos analyzed one sample and did not provide victim totals in the material supplied here. The report does not establish how many computers were infected, whether operators successfully used the malware’s collection and profiling features, or whether any stolen information led to financial loss.
Most importantly, the findings do not confirm that Claude, Kimi or Gemini returned a target assessment. The source material says the malware has fallback models if a request is refused, but it does not report model responses or confirm that the AI step was completed in an observed infection. As of Nov. 2, the supplied material also reports no public statement from Anthropic or OpenRouter about the case.
The watermark announcement is based on customer email reporting, rather than evidence that watermarking affects this malware’s activity. The source material says the watermark does not block misuse and may apply only under default sampling settings on two of the listed models. Its effect on text generated through this particular workflow is not established.
Monitoring for Stolen-Data Traffic
Talos’s findings give defenders specific areas to review. The report recommends restricting which programs can launch Chrome in headless mode, a browser configuration relevant to automated activity. It also advises tracking AI API traffic from ordinary desktop systems, looking for unusual short sessions and being prepared to revoke exposed credentials quickly. These measures can help an organization investigate suspicious activity, though the source does not claim they will prevent every infection.
For individuals, the supplied guidance includes avoiding seed phrases stored in plain-text files and using a password manager. If compromise is suspected, cleanup should be done from a known-clean device; passwords and tokens changed on an infected computer could be exposed again. The report does not describe a confirmed public victim count or a specific remediation notice for affected users.
Further reporting would need to establish whether operators used the AI-generated output, how widely VOLTA has circulated and whether the model providers or OpenRouter have taken action. Until those details are available, the report supports a narrower conclusion: this sample was designed to send a victim profile to AI services, while the outcome and scale remain unknown.
Key Questions
What is VOLTA-AUTODOXER?
VOLTA-AUTODOXER is the name Talos reported for a Windows infostealer sample. The report says it can collect account credentials, browser data and other information, then build a profile of the computer’s user.
Did Claude create a dossier about a victim?
The supplied findings do not confirm that Claude or any other model returned an assessment. Talos described the malware’s request and model settings, but did not report a confirmed model response.
What information can the malware collect?
Talos lists browser passwords, cookies and payment cards; sessions and tokens for online services; email and work-related configuration data; Wi-Fi passwords; screenshots; and cryptocurrency wallets. The report’s list describes possible collection capabilities, not items confirmed stolen from every user.
What can organizations do about the reported behavior?
Talos recommends limiting which programs can launch Chrome in headless mode and monitoring for unusual AI API traffic from desktop computers. It also points to fast credential and token revocation as part of response planning.
How many victims have been identified?
The source material provides no victim count. Talos analyzed one sample, and the scale of infections or any resulting losses remains unknown.
Source: ThorstenMeyerAI.com
