This password stealer hands your data to an AI model and asks what you're worth

Infostealers have always been bulk tools. Infect thousands of PCs, dump everything, sell the logs by the kilo and let someone else dig for the good bits. VOLTA, analysed by Cisco Talos researcher Ryan Fetterman in a report published on 31 October, adds a step: once it's done stealing, it writes you up. The sample first surfaced on 11 October and calls itself VOLTA-AUTODOXER.

The stealing part is thorough rather than novel. Saved passwords, cookies and payment cards from Chrome-based browsers, plus Firefox and Thunderbird. Outlook profiles and Slack workspaces. Logged-in sessions for Discord, Telegram, Steam, Battle.net and Roblox. Microsoft sign-in tokens, screenshots, and every Wi-Fi password the PC has ever saved, plus a cracker for cryptocurrency wallet files. Then comes the odd bit. It uses your stolen Gmail session to search your inbox for receipts from Amazon, DoorDash, Uber Eats, Walmart and PayPal, to confirm your home address, and it looks up the live resale value of your Roblox inventory.

All of that goes, through a broker service called OpenRouter, to a mainstream AI model, by default Anthropic's Claude Opus 4.6, with a system prompt casting it as "a forensic intelligence analyst drafting a target assessment." If the model refuses, the malware checks the reply for phrases like "I can't" and tries Moonshot's Kimi, then Google's Gemini. The report it asks for has two sections: "WHAT THEY'RE WORTH," ranking your assets low, medium or high, and "THEIR OPSEC," a grade for your password habits. Talos puts it plainly: the aim "is not speed or scale but effort displacement." Working out which victims to rob first used to take a person. Now it takes one API call. Talos hasn't reported confirmed victims, and the builder-kit design suggests it's meant to be sold. The defence is dull and effective: don't keep seed phrases or passwords in plain text files, use a password manager with two-step sign-in, and treat any "cracked" download or fake installer as the delivery van this sort of thing arrives in.

Tendvane's Privacy & accounts check is a quick way to see which of your accounts still lean on a single password, which is exactly the weakness a report like this is built to find.