Cisco Talos said on 31 October that it found a Windows stealer calling itself VOLTA-AUTODOXER. After taking passwords, cookies, cards and wallet seed phrases, it builds a profile of the owner, including a home address and employer. Talos says it then sends that profile to an AI model through OpenRouter. The model writes a ranked list of what the victim could be worth.
Talos says the request leaves from the victim's own machine, over their own network connection, before the stolen data goes out. If a model refuses, the malware tries up to three. Talos did not give a victim count or name the operator. The main file may delete itself, so Talos says to keep the volta_debug.txt log.
Talos says all endpoints belong to third parties, and the settings slots suggest the stealer is sold. If so, a buyer of any skill gets ranked targets in a Telegram inbox, with no analyst work. Talos says much of the token theft relies on getting around Chrome's App-Bound Encryption. Allowing only approved programs to start Chrome with --headless, meaning no window, would close that route.