Infostealer Malware: Spooky AI Autodox Is a Brutal Threat

Infostealer malware has always had a sorting problem: it grabs far more than any criminal can read. A new Windows strain called Volta-Autodoxer hands that job to a commercial AI model, which writes a ranked assessment of the person behind the infected machine, including what they are worth and how sloppy their security is. Cisco Talos published the technical analysis on 31 October 2026, the same day WIRED’s Kernel Panic newsletter reported it.

The word in the malware’s own name is the alarming part. This infostealer malware calls itself an autodoxer, and the description fits: it confirms a home address from email receipts, reads takeaway order history, and asks a model to connect the dots. Talos has not said it has seen this in live attacks, and that caveat matters. The design, though, is already complete enough to study, and defenders can act on it today.

Table of contents

What Volta-Autodoxer Is and Why This Infostealer Malware Matters
What This Infostealer Malware Steals on the First Pass
How the Autodox Works: Receipts, Orders and Stolen Sessions
Inside the Prompt That Turns Infostealer Malware Into an Analyst
The Fallback Chain Built to Beat Refusals
Sold as a Kit: Infostealer Malware for Any Customer
How This Compares With Other AI-Assisted Infostealer Malware
How to Defend Against Infostealer Malware Like Volta
What Infostealer Malware Like Volta Means Next
Frequently Asked Questions About Volta-Autodoxer
References

What Volta-Autodoxer Is and Why This Infostealer Malware Matters

A mature stealer with an optional AI layer

Talos describes VOLTA as “a mature stealer implant with an optional AI-integration layer.” That framing is more useful than the headline. At its core this is conventional infostealer malware: a self-deleting Windows executable that sweeps a machine for credentials and sessions. The AI stage arrives late in the workflow, and the implant still functions without it. Talos notes it can run without the model stage altogether if no API key is present.

So the model is not writing the malware, picking exploits or breaking into anything. It is reading what has already been stolen. Ryan Fetterman, the Talos researcher who wrote the analysis, told WIRED: “It’s asking the model to act like an intelligence analyst and produce structured citation-backed assessment of the victim. It’s like a prioritization and analysis function.”

The self-given name and the sample Talos analysed

Talos says the malware is “self-named,” which is why WIRED and Talos both carry the VOLTA-AUTODOXER label. The sample Talos documents is a PE32+ x86-64 executable with a PE timestamp of 17 August 2026 and a first-seen date of 11 October 2026, a gap of 55 days. PE timestamps can be altered, so treat the earlier date as indicative. Filenames in the report are random strings, 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe, so hunting by name is pointless. The SHA-256 hash is in the Talos report for anyone who wants to search their own telemetry.

Who found it, and what has not been established

Talos surfaced the sample through CAIRN, the open research toolkit it released on 22 September 2026 to hunt AI-integrated malware. Three things remain unestablished. Fetterman told WIRED that Talos did not track whether Volta has been used in the wild, which is different from saying it has not been used. The report names no actor. And no victim count exists, so any claim about how widely this infostealer malware has spread would be a guess.

What This Infostealer Malware Steals on the First Pass

The standard haul, and then some

The first sweep looks like any serious infostealer malware, only broader. Talos lists browser passwords, cookies and saved payment cards across Chromium-based browsers, plus Firefox and Thunderbird. It also takes Outlook profiles, Slack workspaces, Microsoft OAuth tokens, SSH keys and config files for gcloud, OpenVPN and Hide.me. Screenshots are captured too. Every saved Wi-Fi password is pulled and dumped to plaintext.

Crypto gets special treatment. This infostealer malware does not just copy wallet files. It runs an embedded cracker against the vault inline and writes the result to a WALLET VAULTS CRACKED line in its report. Seed phrases are collected as well.

A target list tilted towards young, online lives

WIRED’s read is that Volta’s capabilities “seem to be geared toward targeting younger internet users with robust digital lives,” because it goes after active Discord, Telegram, Steam, Battle.net and Roblox sessions. It even values a victim’s Roblox inventory with a live lookup on Rolimons, a trading-value site. That is WIRED’s inference rather than a Talos finding, and Talos does not describe a target demographic. It still reads as plausible, since a corporate-only tool would not bother pricing Roblox items.

Why infostealer malware prefers sessions to passwords

Most of the haul is about sessions rather than passwords. A stolen session token can log an attacker straight in, because the authentication has already happened. That is why the Talos countermeasures centre on token theft. It is also why this infostealer malware is a time-sensitive product: Fetterman points out that tokens expire and passwords change, so stale logs lose value quickly. SecurityWeek reported a real-world example in August: Anthropic warned that infostealers on users’ own computers had let attackers take over Claude sessions and consume usage limits.

Stage	What Volta takes or does	Output
Harvest	Passwords, cookies, cards, wallets, sessions, keys, Wi-Fi, screenshots	volta_log.zip
Profile	Address, employer, inferred birth year, card last-4, Slack workspaces	Identity_Report.txt
Model call	Bundle sent as JSON to OpenRouter with the system prompt	AI_Analysis.txt, volta_dox.zip
Enrichment results	Sent only if the network enrichment produces anything	volta_doxnet.zip

How the Autodox Works: Receipts, Orders and Stolen Sessions

Using your own Gmail against you

The second pass separates this infostealer malware from commodity stealers. Using the victim’s own authenticated Gmail tokens, Volta queries the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal. It then reviews those receipts to establish a confirmed home address. No new break-in is needed, since the session has already been stolen and the mailbox simply answers.

This is the step that lifts infostealer malware into autodox territory. A home address is the piece of information that turns a stolen account into a threat against a person. Receipts are also unusually reliable, because people give retailers their real delivery address.

Order history as a liability

Stolen Uber Eats and DoorDash sessions are called directly for order history, and the Discord token is reused to enrich the account profile. Talos captioned one figure: “That’s right: Your Uber Eats history is now a potential liability.” The joke lands because food orders reveal routines: where someone is at a given time, and how often. Nothing in the report says the model is told to predict movements, so treat that as our reading of why the data is sensitive rather than a documented feature.

The bundle the model receives

All of this is assembled locally into Identity_Report.txt. Talos lists geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators and a live Roblox valuation. Taken alone, each field is ordinary. Together, in one structured file, they are the raw material for a dossier, and this infostealer malware is what compiles them.

Inside the Prompt That Turns Infostealer Malware Into an Analyst

“A forensic intelligence analyst”

Volta’s creators wrote a 240-word prompt, WIRED reports, with bullet points and a numbered list. It opens: “You are a forensic intelligence analyst drafting a target assessment from a structured evidence bundle.” It requires an executive summary and details of what the person does. Talos highlights two further required sections: “WHAT THEY’RE WORTH,” with valuables ranked by monetisation in low, medium and high tiers, and “THEIR OPSEC,” assessing the victim’s security posture and password hygiene.

The instruction to “connect dots across fields” is the striking one. WIRED’s example is checking whether someone’s Wi-Fi password matches their last name, and Talos cites links between names, addresses or universities and password patterns. Talos makes the point precisely: “the model isn’t being asked to find data; rather, it’s being asked to stretch the data and make useful inferences.”

Citations, low temperature and a blunt tone

Two design details show this infostealer malware is built to deliver a usable work product. The prompt asks for a citation-backed assessment, which Talos calls “an auditable trail of citations,” so an operator can check a claim against the source data. The temperature is hardcoded at 0.2, which Talos reads as an emphasis on accuracy and consistency. The tone instruction is plain: “Go deep, not wide… Be blunt, specific, accurate.”

Fetterman also told WIRED that the prompt “is pretty carefully crafted not to imply anything overtly malicious.” That is a guardrail problem in a sentence. An analyst brief can look legitimate, and the harm only becomes obvious if a model infers where the evidence bundle came from. It is also a useful caution about reading this as a story about one vendor’s model, because the wording is built to pass as ordinary work.

What the report does not tell us

Neither source says how often any model actually complied, or shows a real output from a real victim. Talos describes what the code is built to do and notes that volta_debug.txt records whether the LLM call succeeded, but the analysis gives no success rate. So the quality of these dossiers is unknown. A confident dossier built from sparse data could also be confidently wrong, which is a risk for victims and a limit for criminals alike. Readers should not assume the output is accurate simply because this infostealer malware asks for citations.

The Fallback Chain Built to Beat Refusals

Claude first, then Kimi, then Gemini

Volta sends its request to OpenRouter, a service that routes prompts to many AI providers through one API. Talos documents the default model as anthropic/claude-opus-4.6, with a fallback to moonshotai/kimi-k2 and then google/gemini-2.5-flash. Each response is checked for refusal phrases such as “I can’t” or “I’m not able” before the code moves on. The HTTP request is hand-assembled JSON with no SDK and a generic Mozilla/5.0 User-Agent.

The chain is a three-model design, so the operator has already budgeted for two refusals. Talos reads this as evidence of “a direct engineering effort and expectation of hitting model guardrails.” The company names here describe what the attacker configured. They are not evidence that any of those firms approved or knew about the activity, and neither report says any provider has been asked for comment or has acted.

Order	Model string in the binary	Moves on when
1 (default)	anthropic/claude-opus-4.6	Response contains a refusal phrase
2	moonshotai/kimi-k2	Response contains a refusal phrase
3	google/gemini-2.5-flash	Chain ends
No key present	None	Stealer runs without the model stage

Why a fallback list weakens any single guardrail

The structural point goes beyond this one sample of infostealer malware. If an attacker can try several models in sequence, the effective guardrail is the weakest one in the list. Talos describes the fallbacks as “smaller, and more permissive models,” and WIRED notes that fallbacks and cost-effective older-generation models are common attacker techniques. CrowdStrike’s Adam Meyers said much the same to WIRED on 21 October, about four separate hacking groups: “The models don’t all have equivalent guardrails and protections, even from one company.”

Refusal resilience as a design requirement

Talos’s forecast is blunt: “As AI integration in malware matures, refusal resilience may become a standard design requirement.” For AI providers that shifts the question from whether one model refuses to whether abuse can be spotted at the account, key and routing layer. For defenders it is a reminder not to count on refusals. A model saying no may only move this infostealer malware to the next entry on its list.

Sold as a Kit: Infostealer Malware for Any Customer

Six slots and a builder

Hardcoded settings are what you would expect from someone writing infostealer malware for personal use. Volta instead uses a template with six swappable slots for its Telegram channel, API keys and settings, filled in at build time. Talos infers a builder model: the author sells access, the customer supplies values and receives a custom binary. It is an inference, and Talos phrases it as one. WIRED reports Fetterman as saying only that the code contains some clues it was built for a range of attackers.

If that is right, the dossier is not one crew’s private technique but a product feature. Talos spells out the consequence: a customer “of any level of sophistication” can point it at victims and start receiving ranked target assessments in a Telegram inbox.

Encrypted keys that protect nothing

The credentials in those slots are encrypted, but with a key that is the SHA-256 of two constants in the same binary. Talos’s view is that it is there because customers expect their API keys not to sit in plaintext, “not because it provides real protection,” and that anyone who reverses the file can recover them. This has a practical side effect, which is our inference rather than a claim in the report: a captured sample can expose the customer’s own AI credentials, giving responders something concrete to report to the provider.

No infrastructure to take down

Talos says all observed endpoints are third-party controlled and “there is no actor-owned infrastructure.” The model call also runs through the victim’s own network connection, on their own machine, before the result leaves. That changes the usual takedown playbook for infostealer malware. In May 2025 Microsoft and its partners moved against Lumma by seizing, taking down or blocking about 2,300 domains. A stealer living on Telegram and commercial AI APIs offers no such backbone to seize, so disruption depends on those services acting on abuse reports.

How This Compares With Other AI-Assisted Infostealer Malware

Effort displacement, not speed

The most useful phrase in the Talos report is “effort displacement.” Its argument is that “the axis of AI improvement here is not speed or scale” but the removal of analytical work. Talos draws the line to CLOSEDQUORUM, the Windows implant it documented in September, which uses a plurality vote among up to four commercial models to pick its next action. That sample applies the same logic at a different phase: choosing tactics rather than appraising loot.

Dolphin X, another infostealer malware family reported by Varonis in July, is a closer relative. Its seller advertises an “AI behavioral profiler” giving each infected user a risk score and operators a daily summary. Varonis analysed the operator panel and traffic rather than a running sample, so that is a seller’s claim plus panel evidence. Volta differs because Talos documents the actual model strings and the prompt’s wording.

Family	AI job	Models named	Evidence basis
Volta-Autodoxer	Ranks a victim’s assets and security posture	Claude Opus 4.6, Kimi K2, Gemini 2.5 Flash	Talos sample analysis; wild use not tracked
CLOSEDQUORUM	Votes on the implant’s next action	DeepSeek, Qwen, Mistral, Gemini	Static analysis; placeholder keys, deployment unconfirmed
Dolphin X	Scores users, daily ranked summary	Not disclosed	Varonis panel and traffic analysis; capabilities seller-advertised

Why triage matters to infostealer malware operators

Logs from infostealer malware have long fed serious breaches. Mandiant’s 2024 investigation of the Snowflake customer campaign found at least 79.7% of the accounts used had prior credential exposure, and it notified about 165 potentially exposed organisations. Some of those credentials were not rotated for as long as four years. Microsoft identified more than 394,000 Windows computers infected by Lumma in just two months of 2025. The supply is enormous, so attention is the bottleneck, and triage is where infostealer malware operators stand to gain most.

Fetterman’s version: “If you’re able to identify your high-value targets faster, you probably have a better chance of using their credentials or authenticating using stolen tokens more often.” Talos’s closing line puts it more memorably: “there is a difference between a wide net and a wide net that sorts itself.” Whether this lowers the floor, raises the ceiling or both is, by Talos’s own account, an open question. There is also a counter-trend worth noting, as WIRED reports low-level criminals complaining about AI slop filling their forums.

The chart below uses counts stated in the Talos report, plus one line of our own arithmetic: a chain of three models can absorb two refusals, because the third model is the last one it can try.

Volta by the numbers, from the Talos report

Swappable build slots 6

Models in the fallback chain 3

Exfiltration stages 3

Refusals tolerated before the chain ends 2

How to Defend Against Infostealer Malware Like Volta

What Talos recommends

Much of Volta’s token theft relies on bypassing App-Bound Encryption, the protection Chrome added on Windows in version 127 in 2024. Talos’s headline control is specific: an application control policy restricting which processes may launch Chrome with --headless would, it says, block that decryption path entirely. At minimum, alert when Chrome starts with --headless from a process outside known developer use. Talos also advises storing credentials in hardware-backed stores. These are low-cost checks that do not depend on knowing this particular infostealer malware by name.

What infostealer malware looks like on the network

An unexpected process calling openrouter.ai is worth investigating, particularly on a machine with no reason to use AI services. Talos made a similar behavioural point about CLOSEDQUORUM: look for an unexpected executable calling LLM providers alongside suspicious activity. One caution applies, because plenty of legitimate tools now call these endpoints, so blocking them outright will catch your own developers. Treat it as a signal to correlate with process lineage rather than a verdict.

If you think infostealer malware has hit you

The executable may have deleted itself, but Talos asks responders to preserve %APPDATA%\volta_debug.txt, a timestamped log of what was collected and whether the LLM call succeeded. The order below is our suggestion: token revocation, password changes and the wallet advice come from Talos, while isolation, the Wi-Fi point and the phishing warning are our additions.

Isolate the machine, and clean or rebuild it before anyone re-enters new credentials on it.
Revoke sessions and tokens first, because a changed password alone may not end a live session.
Change passwords, including saved Wi-Fi passwords, since Volta dumps those in plaintext.
Treat any wallet with a plaintext seed phrase as fully compromised, and move funds to a wallet with a seed generated on an air-gapped device.
Assume your home address and employer may now be known, and be wary of unusually well-informed phishing or extortion messages.

That last step follows from the design rather than from a documented attack. It is the practical change this infostealer malware brings: a message quoting a recent order may be built on stolen data, not proof of anything else. If you need outside help, see our incident response service. A penetration testing exercise can also show how far one stolen session would travel in your estate, and broader controls sit under our security services.

What Infostealer Malware Like Volta Means Next

A small part of a bigger pattern

Keep the proportions of this infostealer malware story in view. Volta is one documented sample, with no confirmed deployment, an optional AI layer and unknown output quality. CAIRN’s own authors call that effort “a research effort, not a pure active threat signal,” and say it is too soon to tell whether AI-integrated malware stays experimental. Spooky is a fair word for a tool that reads your takeaway receipts, but nothing yet shows dossiers arriving at scale.

The direction is still clear

Yet the pattern fits other findings. CrowdStrike told WIRED on 21 October about four groups using AI to compromise targets, and in almost all cases they used older models rather than frontier ones. Talos says the question for defenders “is not whether this pattern will appear elsewhere, but which phase it touches next.” Fetterman’s summary to WIRED: “We’re seeing more advanced capabilities accessible to lower-level sophistication attackers. It’s really interesting and disturbing.”

Where this leaves ordinary people and small firms

For individuals, the old advice is unchanged because it still works: avoid counterfeit software, which WIRED notes often hides infostealers, use a password manager and unique passwords, and turn on multi-factor authentication, ideally phishing-resistant passkeys. Sign out of sessions you no longer need. For small firms, the useful change is to stop treating an infostealer malware infection as a password reset. Infostealer malware now threatens the person as well as the account, and cybersecurity plans should treat a home address leak as part of the incident.

Related reading on this site covers infostealer malware and AI abuse from other angles, including MFA bypass and the modern extortion playbook, the business of removing AI guardrails, and our AI models and tools hub.

Frequently Asked Questions About Volta-Autodoxer

What does “autodox” mean here?

Doxing means exposing someone’s private details, such as a home address. The malware’s self-given name suggests automating the collection, and here the output is an assessment for the operator, not a public post. This infostealer malware compiles the dossier; nothing in the reports says it publishes one.

Has Volta-Autodoxer been used against real victims?

Not established. Fetterman told WIRED that Talos did not track its use in the wild. A first-seen date shows a sample was observed, not that anyone was attacked with it.

Did Anthropic, Moonshot or Google do anything wrong?

Neither report alleges that. The malware’s author hardcoded those model names and routes requests through OpenRouter. The reports do not say how the models responded in practice.