VOLTA-AUTODOXER, a self-deleting Windows malware, steals victim data and feeds it to Anthropic's Claude AI model to rank assets by monetary value before erasing itself, according to a report by Cisco's Talos research organization. The malware uses Claude Opus 4.6 by default to generate target assessments, with fallback options to Kimi K2 and Gemini 2.5 Flash if the primary model refuses the request. VOLTA operates as a commercial product designed for resale, with customizable build configurations that allow attackers to receive ranked victim profiles via Telegram without maintaining their own infrastructure.
VOLTA Steals Browser Data and Cryptocurrency Wallets
VOLTA extracts browser passwords, cookies, and saved payment cards from infected systems. The malware targets Thunderbird and Outlook email profiles, Roblox accounts, Microsoft OAuth tokens, screenshots, and SSH and cloud-provider configuration files. Every saved Wi-Fi password is pulled in plaintext. When cryptocurrency wallets are present, VOLTA attempts to crack their vaults inline rather than simply copying them.
Malware Uses Claude to Generate Target Assessments
The malware builds a structured evidence bundle and sends it to an AI model with a prompt instructing it to act as "a forensic intelligence analyst" and to be "blunt, specific, accurate." VOLTA uses Claude Opus 4.6, a model released in February, at a temperature setting of 0.2. The low temperature value prioritizes predictable output over randomness. If Claude refuses the request, VOLTA switches to Moonshot AI's Kimi K2, then to Google's Gemini 2.5 Flash. The malware can operate without the AI step entirely if no OpenRouter API key is supplied.
VOLTA Builds Victim Dossiers with Live Data Enrichment
The malware assembles victim data locally as Identity_Report.txt and converts it to JSON format. The evidence bundle includes geolocation and home address, employer and employer domain, inferred birth year, document authorship metadata, and the last four digits of payment cards. VOLTA searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to confirm addresses. The malware pulls Uber Eats and DoorDash order histories, reuses stolen Discord tokens to fill in victim profiles, and values Roblox items through Rolimons. The inference call occurs over the victim's own network connection.
Cisco Talos Reports Malware Detection Methods
VOLTA appears designed as a resale product with six customizable slots for Telegram channels, API keys, and settings that are filled at build time. The malware bypasses Chrome's App-Bound Encryption by launching Chrome headless without a graphical interface. An application-control policy limiting which processes may launch Chrome headless blocks this decryption method. After infection, the main executable may delete itself, but a volta_debug.txt log file shows what data was collected and whether the AI call succeeded. Cisco Talos recommends victims revoke all API keys and tokens, change passwords, and move cryptocurrency funds to new wallets with fresh seed phrases generated on air-gapped devices.
FAQ
What does VOLTA-AUTODOXER malware do after stealing data?
VOLTA-AUTODOXER sends stolen data to Anthropic's Claude AI model to generate a target assessment ranking the victim's assets by monetary value. The malware then exfiltrates both the data and AI analysis via Telegram before deleting itself from the infected system.
Which AI models does VOLTA malware use?
VOLTA uses Claude Opus 4.6 by default, released in February. If Claude refuses the request, the malware switches to Moonshot AI's Kimi K2, then to Google's Gemini 2.5 Flash. The malware can operate without AI analysis if no OpenRouter API key is provided.
