Cisco Talos Says a New Infostealer Asks Claude What Its Victims Are Worth
Cisco Talos researchers say a new Windows infostealer sends its stolen haul to an AI model and asks it to rank the victim by what they are worth. It also switches to other chatbots if one refuses.
Most malware steals your data and moves on. A Windows infostealer that Cisco Talos researchers have dissected adds a step that reads like a bad joke about the AI age: it hands the haul to a chatbot and asks what the victim is worth.
The malware calls itself Volta-Autodoxer. Talos published its technical write-up on Saturday, and WIRED got the details first in its Kernel Panic newsletter. Talos flagged it with CAIRN, a new framework built to spot hacking tools that bolt on AI.
"Volta is pretty mature as a stealer. It casts a pretty wide net for what it collects." Ryan Fetterman, security researcher at Cisco Talos
That wide net is the old part. Talos says Volta grabs browser passwords, cookies, payment cards, crypto wallet seed phrases, Microsoft OAuth tokens and live Discord, Telegram, Steam and Roblox sessions. Then it uses those stolen sessions to dig deeper, searching the victim's Gmail for receipts and pulling UberEats and DoorDash order history to work out where they live and how they spend. WIRED says it looks geared toward younger people with busy digital lives.
The new part comes next. Volta packages everything into a dossier and sends it through OpenRouter, a service that routes prompts to different AI providers. Talos says the instructions tell the model to act as a forensic intelligence analyst drafting a target assessment. The required output includes a section on what the victim is worth, with valuables ranked by how easy they are to cash in, and another on their opsec, meaning how careful they are with security and passwords.
WIRED reports the prompt runs about 240 words. It tells the model to connect dots across fields, such as checking whether a Wi-Fi password matches someone's last name, and it ends with a blunt order: go deep, not wide.
The chatbot gets a vote, and the crooks planned for a no
Here is the detail that should interest AI companies. According to Talos, Volta defaults to Anthropic's Claude Opus 4.6. It then scans each reply for refusal phrases such as "I can't" and, if it finds one, moves down a chain to Moonshot AI's Kimi K2 and then Google's Gemini 2.5 Flash. Talos reads that as a sign the authors expected to hit guardrails and engineered around them.
"The prompt is pretty carefully crafted not to imply anything overtly malicious." Ryan Fetterman, security researcher at Cisco Talos
The model names describe what the code calls, not anything the AI companies did, and neither Talos nor WIRED reported a response from them. Still, the design shows the limit of safety by refusal. If one model says no, a script can simply ask the next one.
Keep the hype in check. Fetterman told WIRED that Talos did not track whether Volta has been used in the wild, so there is no public count of victims. The AI step is also optional. Fetterman says the implant still works without it and calls the AI calls "above and beyond."
Talos also says the code looks like a product, built from a template with swappable slots, which suggests an author selling custom builds. Fetterman told WIRED it may have been made for a range of attackers rather than one campaign. If so, the AI dossier is a feature anyone could buy, not a trick for elite crews.
Criminals using chatbots is not new. WIRED notes that CrowdStrike recently described four hacking groups using AI tools to compromise dozens of targets, and we have covered AI-assisted intrusions such as the Chainalysis breach. Volta is a different animal. Nobody breaks in with AI here. The AI only sorts the loot.
"We're seeing more advanced capabilities accessible to lower-level sophistication attackers. It's really interesting and disturbing." Ryan Fetterman, security researcher at Cisco Talos
Fetterman's worry is speed. Tokens expire and passwords get changed, he told WIRED, so spotting high-value targets faster means a better chance of using their stolen logins in time. Talos ends its post with a question: whether handing the dullest part of crime to a model changes much, or just makes a wide net sort itself.
