# Windows infostealer uses AI to rank victims' assets for theft

_Published Sunday, November 1, 2026 at 4:42 PM EST · Security, AI · Latest · Tier 2 — Notable_

![Illustration of six dartboards on a green carnival-game shelf, each with a person icon at the center and pinned cards showing a password, a home, a location pin, cash and a bank — Primary](https://cdn.mos.cms.futurecdn.net/SwXoTJq5pcxA7urt6ryrQZ-1744-80.jpg)

Windows malware called VOLTA-AUTODOXER uses stolen personal data to request AI assessments of victims and rank their assets by cash-out value, Cisco Talos researchers report. It collects passwords, session tokens, email profiles and cloud configuration files, then uses stolen sessions to enrich dossiers with addresses and purchase histories.

The malware sends those dossiers through OpenRouter, using Claude Opus 4.6 by default and switching models after refusals. It sends the dossier and any AI assessment through Telegram; theft can proceed without an AI call. Restricting which processes can launch Chrome without a graphical interface blocks its Chrome session decryption method, but leaves other theft and exfiltration paths intact.

## Sources

- [Tom's Hardware](https://www.tomshardware.com/tech-industry/cyber-security/new-ai-driven-windows-malware-feeds-stolen-data-to-claude-to-rank-victims-assets-by-value-then-deletes-itself-payload-builds-custom-target-assessment-can-switch-models-if-one-refuses-or-skip-the-ai-step-entirely)

---
Canonical: https://techandbusiness.org/newswire/25oeaaAZZWeplvgPwOLcBg
Published: 2026-11-01T21:42:42.434Z
Story chronology: 2026-11-01T21:00:00.000Z
Retrieved: 2026-11-02T01:08:09.547Z
Publisher: Tech & Business (techandbusiness.org)