Windows infostealer uses AI to rank victims' assets for theft

Windows malware called VOLTA-AUTODOXER uses stolen personal data to request AI assessments of victims and rank their assets by cash-out value, Cisco Talos researchers report. It collects passwords, session tokens, email profiles and cloud configuration files, then uses stolen sessions to enrich dossiers with addresses and purchase histories. The malware sends those dossiers through OpenRouter, using Claude Opus 4.6 by default and switching models after refusals. It sends the dossier and any AI assessment through Telegram; theft can proceed without an AI call. Restricting which processes can launch Chrome without a graphical interface blocks its Chrome session decryption method, but leaves other theft and exfiltration paths intact.