GoKawiilWindows infostealer VOLTA-AUTODOXER uses Claude to rank stolen victim assets
Cisco Talos has detailed a self-deleting Windows infostealer dubbed VOLTA-AUTODOXER that harvests browser credentials, payment cards, email accounts, crypto wallets, Wi-Fi passwords and cloud configuration files, then compiles the data into a structured 'evidence bundle.' The malware sends this bundle to an AI model, Anthropic's Claude by default via OpenRouter, with a prompt to act as a forensic analyst and rank the victim's assets by cash-out value, saving the response as AI_Analysis.txt before exfiltrating everything and deleting itself.
GoKawiil's interpretation of the reporting above, not reported fact.
By having an AI model synthesize stolen data into an actionable profile, attackers could cut down the manual work normally needed to prioritize which victims are worth pursuing further, potentially speeding up and scaling fraud or extortion campaigns. The malware's ability to switch models if one refuses suggests operators are already anticipating AI safety guardrails and building workarounds, which could complicate efforts by AI providers to prevent misuse of their tools.
- VOLTA-AUTODOXER steals browser data, emails, crypto wallets, Wi-Fi passwords and cloud credentials before self-deleting.
- It sends stolen data to Claude or another AI model via OpenRouter to rank a victim's assets by potential cash value.
- The malware enriches stolen data using live account access, such as Gmail receipts and Discord tokens, to build detailed victim profiles.
YubiKey 5 NFC Security Key — With infostealers now harvesting saved passwords, cookies, and OAuth tokens en masse, relying on browser-saved credentials alone is risky. A hardware security key like the YubiKey 5 NFC adds a physical authentication factor that stolen passwords and cookies can't bypass. It's a practical, concrete step toward protecting accounts even if malware exfiltrates your stored credentials.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Shane Downing, 2026-11-01
Published there as: “New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.