A newly identified Windows malware strain is combining large-scale data theft with artificial intelligence to profile victims and rank them by their potential value to cybercriminals. Cisco Talos researchers discovered the threat through CAIRN, an open-source research kit designed to identify and track AI-powered malware.

Named VOLTA-AUTODOXER, the malware follows four main stages: collecting information from an infected device, sending the stolen data for AI analysis, transferring the data to infrastructure controlled by the attackers, and removing itself from the system.

At first glance, VOLTA resembles a conventional infostealer. It can collect browser passwords, cookies, payment-card details, cryptocurrency wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles and screenshots.

Its distinguishing feature is the creation of a structured dossier about the victim. The malware gathers information such as geographical location, home address, employer and employer domain, an inferred birth year, the final four digits of credit cards, Slack workspaces, document-author metadata, iPhone backup indicators and an estimated Roblox account value. It also searches Gmail for UberEats and DoorDash messages, apparently to help confirm a home address.

The collected information is serialized and sent through OpenRouter, an AI infrastructure platform that provides access to multiple language models through a single API. The malware instructs the selected model to act as a forensic intelligence analyst preparing a target assessment. The resulting analysis is intended to determine whether the victim is worth pursuing and how valuable the stolen information might be.

Claude is listed as the default model, while Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash are named as alternatives if the first model refuses to process the request. If the AI services do not work, VOLTA can send the raw data to the attackers, typically through a Telegram channel.

Cisco Talos said the collected assessments could help attackers prioritize victims for further activity, including ransomware operations. The researchers did not disclose where the malware was found, how many systems it had infected or how it was being distributed.

After completing its activity, VOLTA attempts to delete itself. However, a file named volta_debug.txt may remain on the system and record the information collected and whether the AI assessment succeeded.

The researchers believe the malware may be intended for sale on the black market. Telegram details and API keys are not hardcoded, and the malware reportedly includes six configurable slots that can be filled when a build is created. Cisco Talos said this structure is consistent with a builder model in which a seller provides the malware framework and customers supply their own settings for customized binaries.

For users who suspect an infection, the researchers recommend revoking or rotating API keys and tokens, changing passwords and checking cryptocurrency wallets. They also advise moving any remaining funds to a new wallet protected by a newly generated seed.

Sources: TechRadar.