New malware VOLTA-AUTODOXER uses AI to rank stolen data by value

Cisco Talos researchers disclosed a Windows infostealer named VOLTA-AUTODOXER that calls large language models through OpenRouter to assess and rank stolen victim data by monetization value. The trojan steals browser passwords and cookies, payment card information, crypto wallet seed phrases, Discord, Telegram, Steam and Roblox session tokens, SSH and cloud keys, and compiles victim profiles including home address, employer, last four digits of credit cards and Roblox account valuation, and also searches the victim's Gmail receipts to corroborate the address. The AI analysis prefers Anthropic's Claude Opus 4.6, falling back to Moonshot AI's Kimi K2 or Google's Gemini 2.5 Flash when refused, rotating through at most three models, and uses a 240-word system prompt to have the model act as a forensic intelligence analyst, outputting a list of assets ranked by monetization potential and an assessment of the victim's security posture.