Cisco Talos said it found a Windows infostealer that calls itself VOLTA-AUTODOXER. An infostealer is malware that steals saved logins and other private data. Talos said it takes browser passwords, cookies, payment cards, crypto wallet seed phrases and chat sessions. It then uses stolen sessions to search Gmail receipts and confirm a home address. It sends the file to OpenRouter, a service that routes requests to AI models. The model must write a target assessment, including a ranked list of what the victim is worth. Wired reported that Talos found the malware with its CAIRN framework.
Talos said the malware tries up to three models if one refuses. It deletes itself, and every endpoint Talos saw is run by a third party. Wired reported the order as Claude Opus 4.6, then Kimi K2, then Gemini 2.5 Flash. Wired also reported that Talos did not track whether the malware has been used in the wild. Talos thinks it may be sold as a builder to paying customers, but calls that an inference. The Wired text provided cuts off before the end of the article.
For teams that defend Windows machines, Talos says the AI step takes over the slow work of sorting stolen data. Talos advises blocking untrusted programs from launching Chrome with the --headless flag, and storing credentials in hardware-backed stores.