GoKawiilWindows infostealer VOLTA-AUTODOXER uses Claude to rank stolen victim assets
Cisco Talos has detailed a self-deleting Windows infostealer dubbed VOLTA-AUTODOXER that harvests browser credentials, payment cards, email accounts, crypto wallets, Wi-Fi passwords and cloud configuration files, then compiles the data into a structured 'evidence bundle.' The malware sends this bundle to an AI model, Anthropic's Claude by default via OpenRouter, with a prompt to act as a forensic analyst and rank the victim's assets by cash-out value, saving the response as AI_Analysis.txt before exfiltrating everything and deleting itself.