Analysts from Cisco Talos research organization have discovered a new threat — a self-deleting info-stealer virus for Windows called VOLTA-AUTODOXER. The main feature of the malware is the use of artificial intelligence to analyze stolen data: it transfers the collected information to an AI model that estimates the financial and analytical value of the victim.
Analysts from Cisco Talos research organization have discovered a new threat — a self-deleting info-stealer virus for Windows called VOLTA-AUTODOXER. The main feature of the malware is the use of artificial intelligence to analyze stolen data: it transfers the collected information to an AI model that estimates the financial and analytical value of the victim.
The virus steals browser passwords, cookies, saved bank cards, Outlook and Thunderbird profiles, Microsoft OAuth and Discord tokens, correspondence and configuration files of cloud services and SSH. In addition, it extracts all Wi-Fi passwords in plain text and hacks existing cryptocurrency wallets. Thanks to the stolen sessions, the virus searches Gmail for receipts from Amazon, Uber Eats, DoorDash, PayPal or Walmart, collecting home addresses, workplaces, dates of birth and activity analytics, Tom's Hardware reports .
Having collected the “dossier”, the virus sends it through the OpenRouter gateway to the language model (by default it is Anthropic Claude Opus 4.6). The prompt requires the AI to act as a “forensic intelligence analyst”. The model must analyze the victim’s wealth, generate a ranked list of their assets that can be quickly monetized, and also assess their level of cyber hygiene.
If the selected model refuses to process data due to ethical constraints, VOLTA automatically switches to other models — Kimi K2 (Moonshot AI) and Gemini 2.5 Flash (Google) in turn. If API keys are missing or all models reject the request, the program sends the stolen information to hackers via Telegram without AI analysis.
After the virus is finished, its executable file is deleted from the computer. All communication takes place through third-party services and the victim's own network connection, so the attackers don't even need to maintain their own servers.
Experts note that the virus bypasses Chrome's protection (App-Bound Encryption) by running the browser in the background. Implementing application control policies that prohibit third-party processes from running Chrome in the background stops the decryption of browser sessions.
If infection is suspected, experts recommend immediately:
reset and change all passwords and API keys;
terminate all active sessions and revoke access tokens;
transfer cryptocurrency funds to new wallets with recovery phrases generated on isolated devices.
