Volta malware: having Claude assess how much each victim is worth

Cisco Talos published an analysis on October 31, disclosing a Windows infostealer that calls itself VOLTA-AUTODOXER; after stealing passwords, cookies and cryptocurrency wallets, it sends the victim's profile to commercial AI models, having the models act as forensic intelligence analysts to output asset valuations and assessments of security habits. The default model is Anthropic Claude Opus 4.6 called via OpenRouter, and after detecting refusal phrases it falls back in order to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash. The analysis is based on a single sample first discovered on October 11, with no known attack campaign or victims, and whether the models actually cooperate has not been tested; Talos speculates that the trojan is sold on a builder model, with AI valuation becoming a product feature that lets low-skill buyers also obtain target assessments.