New Malware Uses AI to Rank Victims by Financial Value

Researchers have identified a new malware strain, dubbed VOLTA-AUTODOXER, that utilizes artificial intelligence to profile victims and determine the potential monetary value of their stolen data. The malware steals sensitive information from Windows computers and then employs AI models to categorize data based on perceived worth.

Cisco Talos researchers uncovered the malware during a cybersecurity research project focused on AI-powered threats. VOLTA-AUTODOXER goes beyond typical information-stealing malware by not only collecting data but also analyzing it. The malware can steal saved browser passwords, payment card information, login sessions, cryptocurrency wallet data, and even work-related credentials. It compiles detailed reports that can include location, employer information, and clues about a user's age. It can also gather screenshots and information from applications like Microsoft Outlook and Slack.

The AI component is central to the malware's strategy. After data collection, it sends the information to an AI model through the OpenRouter platform, instructing it to act as an intelligence analyst. The AI is tasked with identifying the most valuable stolen information and assigning it a ranking of low, medium, or high. Researchers noted that the malware is designed to attempt multiple AI models if the primary one refuses the request, including Anthropic's Claude, Moonshot AI's Kimi K2, and Google's Gemini 2.5 Flash.

VOLTA-AUTODOXER can also delve into personal details such as food delivery receipts from services like Uber Eats, DoorDash, Grubhub, and purchase history from Amazon and Walmart. This information can help criminals confirm a victim's home address and connect online activity to real-world identities. The malware can even examine Roblox accounts to assess the value of virtual items.

This AI-driven profiling aims to streamline the criminal process, enabling attackers to identify high-value targets more efficiently than manual review would allow. The malware includes a section called "THEIR OPSEC" to examine a victim's security habits and password practices.

An additional feature of VOLTA-AUTODOXER is its ability to delete its main executable after completing its task, potentially making investigations more difficult. However, a diagnostic file, volta_debug.txt, may be left behind, containing records of collected data and the success of the AI analysis.

While researchers have identified these capabilities, they have not confirmed that criminals have successfully used these AI-generated rankings to target real-world victims. The first analyzed sample was observed on October 11, 2026, but the extent of its spread and specific distribution campaigns remain unknown.

To protect against such threats, cybersecurity experts recommend maintaining robust antivirus software, using strong and unique passwords managed through a password manager, enabling two-factor authentication (2FA) wherever possible, and keeping operating systems and applications updated. Reducing the amount of personal information shared online and regularly reviewing financial statements and credit reports are also advised. For work-related accounts, users should follow company security policies and report suspicious activity promptly.

If a computer is suspected of being infected, immediate steps include disconnecting it from the internet, running a trusted security tool for investigation, changing critical passwords from a separate device, and notifying financial institutions or employers if necessary. For cryptocurrency holders, moving funds to a new, securely generated wallet is recommended.