Science & Tech · Cybersecurity · 2 hrs ago
Windows malware uses AI to rank victims by the value of stolen data
Cisco Talos researchers identified Windows malware called Volta-Autodoxer that uses AI to assess people whose computers it infects.
The self-deleting program steals a wide range of data, including passwords, payment details, email profiles and cryptocurrency wallet information.
It also collects clues such as a person’s location, employer and online accounts to build a detailed profile.
The malware sends that profile to AI models and asks them to rank the victim’s valuable assets and summarize their security habits.
It uses Anthropic’s Claude by default, with other models available as backups.
This could help attackers decide whom to target, but Talos researchers did not track whether Volta has been used in real attacks.
Cisco Talos researchers report that a Windows infostealer called Volta-Autodoxer uses AI to assess the value of stolen data.
The malware gathers information from infected computers and compiles it into a structured dossier about each victim.
It sends the dossier to AI models and asks for a target assessment, including what the victim may be worth.
Volta steals credentials, payment details, account data and other information, and can make a deeper sweep through email accounts.
Talos flagged the malware with its CAIRN framework but did not track whether it has been used in the wild.
- Who
- The malware is called Volta-Autodoxer. Cisco Talos researchers reported the finding.
- What
- It steals data from Windows computers and uses AI to profile victims and rank their assets by value.
- When
- The reports were published on October 31 and November 1, 2026.
- Where
- On infected Windows computers; the malware sends collected data to AI tools through OpenRouter.
- Why
- It asks AI to assess victims and identify valuable information and assets. The sources do not state who created it or their motive.
This story does not have two clearly opposing sides.
Wired reported on Cisco Talos research into Volta-Autodoxer.
Tom's Hardware reported that the malware uses AI to rank victims’ assets by potential value.
- Malware name
- Volta-Autodoxer
- Research organization
- Cisco Talos
- Default AI model
- Anthropic’s Claude Opus 4.6
- Fallback AI models
- Moonshot AI Kimi K2 and Google’s Gemini 2.5 Flash
- Detection framework
- CAIRN
- Wild use
- Talos did not track whether Volta has been used in the wild
3 sources
What people are saying
It’s like a prioritization and analysis function.
The prompt is pretty carefully crafted not to imply anything overtly malicious,