The new malicious program VOLTA-AUTODOXER, discovered by researchers at the cybersecurity unit Cisco Talos, targets the Windows operating system and uses artificial intelligence capabilities to analyze stolen information. The neural network automatically assesses how well-protected accounts are and identifies the user's most valuable digital assets.
What exactly the virus steals and how the dossier is compiled
The malware is capable of stealing a wide range of data, including passwords saved in browsers, payment details, and seed phrases for restoring crypto wallets. In addition, the virus steals access keys to cloud storage, data from gaming services and messengers, as well as Wi-Fi network passwords and screenshots.
- Using intercepted sessions, the program scans Gmail for receipts and food delivery history to confirm the home address
- The final dossier includes information about the employer, the approximate year of birth, accounts in the Slack corporate workspaces and the value of the Roblox account
How the AI component works and how data is transmitted
To analyze the collected information, the virus contacts the OpenRouter service. The main working model is Claude Opus 4.6, which prepares a report on the value of assets and the strength of passwords. If it fails, the program automatically switches to the Kimi K2 and Gemini 2.5 Flash neural networks.
After compiling the analytical report with the stolen data, the information is forwarded to the attackers via the Telegram messenger, after which the program itself self-destructs. A service file, volta_debug.txt, listing the stolen information may remain on the infected computer.
In brief · TL;DR
- The VOLTA-AUTODOXER virus targets Windows and uses AI to assess data
- It steals passwords, payment details, seed phrases and data from cloud services
- It uses Claude Opus 4.6 for analysis, switching to Kimi K2 and Gemini 2.5 Flash
- The compiled dossiers are sent to attackers via Telegram
