New AI-driven Windows malware VOLTA-AUTODOXER hands stolen data to Claude, which ranks the victim's assets by value, then deletes itself
New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses,
Cisco Talos reported finding a self-deleting Windows infostealer named VOLTA-AUTODOXER that, after stealing data from the victim's computer, by default calls Anthropic's Claude to organize the stolen information into a structured evidence package and has the model list the victim's belongings by monetization value. The malware's prompt instructs the model to act as a forensic intelligence analyst and to answer directly, specifically and accurately; if the model refuses, it can switch to other models or even skip the AI step entirely. Its theft scope includes browser passwords, cookies, saved payment cards, Thunderbird and Outlook mail configurations, Roblox accounts, Microsoft OAuth tokens, screenshots, and SSH and cloud provider configuration files; saved Wi-Fi passwords are obtained in plaintext; for cryptocurrency wallets it does not merely copy them but attempts to crack their vaults directly. It also builds a victim profile, including geolocation and home address, employer and employer domain, inferred birth year, document author metadata and the last four digits of payment cards.