Cybersecurity researchers at Cisco Talos have identified a new strain of Windows malware that goes beyond simply stealing personal data — it uses artificial intelligence to analyze what it steals and estimate how valuable each victim could be to criminals.
The malware, named VOLTA-AUTODOXER, was uncovered through a Cisco Talos research project examining AI-powered cyber threats. According to the researchers, it can steal saved browser passwords, payment card information, login sessions, cryptocurrency wallet data and certain work-related credentials. It also collects saved Wi-Fi passwords, screenshots, and information pulled from applications such as Microsoft Outlook and Slack.
Once the data is gathered, the malware sends it to an AI model through a platform called OpenRouter, instructing the model to act as an intelligence analyst and determine which stolen information is most valuable. Researchers found that the AI component is optional — if it fails or is unavailable, the malware still collects and transmits the stolen information to attackers.
Everyday Receipts Become Identity Clues
The malware’s reach extends into ordinary digital habits. Cisco Talos found that it searches Gmail and stolen login sessions for purchase records from services such as Uber Eats, DoorDash, Grubhub, Walmart, Amazon and PayPal. Those receipts can help confirm where a victim lives. The malware can also gather clues about a person’s age, employer, and even examine Roblox accounts to estimate the value of virtual items.
Researchers say the AI is specifically prompted to generate a report with a section titled
