VOLTA-AUTODOXER malware uses AI to rank victims

Cisco Talos researchers have identified a Windows malware strain called VOLTA-AUTODOXER through CAIRN, an open-source cybersecurity research kit for identifying and tracking AI-powered malware.

The malware gathers personal and work-related information from an infected device, including its geographic location, home address, employer, inferred birth year, the last four digits of credit cards, Slack workspaces, document authorship metadata, iPhone backup indicators and an estimated value for a live Roblox account. It also checks Gmail for messages from UberEats and DoorDash to help confirm a home address.

VOLTA-AUTODOXER sends the collected information to OpenRouter, where an AI model is prompted to act as a “forensic intelligence analyst drafting a target assessment.” The malware uses the assessment to rank victims by value, apparently to help attackers select targets for ransomware. Its default model is Claude, with Kimi K2 and Gemini 2.5 Flash listed as fallbacks. If those models do not work, it sends raw data to the attacker, usually through a Telegram channel.

The researchers say the malware appears designed for sale on the black market. Its Telegram channel and API keys are not hardcoded; the malware is supplied as a template with six customizable slots. Cisco Talos says this points to a builder model in which customers provide values for a custom binary. After running, the malware is instructed to delete itself, though a file named volta_debug.txt may remain.