AI-driven infostealer VOLTA-AUTODOXER picks out the most valuable parts of stolen data

Cisco Talos found a Windows infostealer named VOLTA-AUTODOXER that organizes stolen data into a profile and sends it to a large model, asking it to rank the victim's assets by ease of monetization and label them low, medium or high. The malware first steals browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Microsoft OAuth tokens and SSH keys as usual, then uses the stolen sessions to check Gmail shopping receipts and UberEats and DoorDash orders to fill in information such as home address and employer. Requests are sent by default via OpenRouter to Claude Opus 4.6, and if refusal wording appears in the reply they are forwarded in turn to Kimi K2 and Gemini 2.5 Flash; Talos believes this multi-model design is meant to anticipate refusals. The malware deletes itself after running and connects only to third-party endpoints; its configuration template leaves six slots for the builder to fill in, which researcher Fetterman says suggests it is sold customized to order.