Trojan horse malware ranks victims with AI

Security researchers have discovered that a new infostealer running on Windows uses a language model to interpret the data it steals and rank victims by value. An analysis published on October 31, 2026, by Cisco Talos researcher Ryan Fetterman describes a self-deleting malware called VOLTA-AUTODOXER. Talos describes VOLTA as a mature stealer that also carries an optional AI layer.

According to the analysis, the servers behind the malware do not belong to the attackers; all observed endpoints are controlled by third parties. In other words, the attacker operates through off-the-shelf services without building their own infrastructure. The malware was caught by Talos’s CAIRN program, which tracks AI-enabled malware.

The model turns stolen data into an intelligence dossier

According to Talos, the novelty of the AI layer is not speed or scale. The model turns an ordinary credential record into a file that ranks the victim’s monetizable assets and cites sources. Here, instead of supporting a standard malicious function, the model behaves like an intelligence analyst working on behalf of the operator.

Data collected in a single pass

When the malware runs once, it collects passwords, cookies, and saved card details from Chromium-based browsers. Firefox and Thunderbird data, Outlook profiles, Slack, Discord, and Telegram sessions, Steam and Battle.net accounts, SSH files, cloud configurations, and Wi-Fi profiles are also taken in the same pass.

It does not stop at copying wallet files; in the same pass it tries to crack the wallet vault and writes the result to its report as a “WALLET VAULTS CRACKED” line. Saved Wi-Fi passwords are also dumped in plaintext with a single call.

Live enrichment with stolen sessions

The collected data is then enriched through stolen sessions. The victim’s home address is verified by searching their inbox with the stolen Gmail token for Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal receipts. Order history is pulled directly, the Discord profile is enriched, and the Roblox inventory is valued through Rolimons.

All of this material is turned into a structured file locally: home address, employer, estimated birth year, last four digits of the card, Slack workspaces, and document author information. The result is saved as Identity_Report.txt and JSON.

A three-model chain through OpenRouter

The prepared package is sent to OpenRouter’s chat completion endpoint. The system prompt asks the model to take on the role of a forensic intelligence analyst preparing a target assessment. In the output, the “WHAT THEY’RE WORTH” section ranks assets as low, medium, and high; the “THEIR OPSEC” section assesses the victim’s security posture and password habits. The prompt also pushes the model to correlate scattered data such as names, addresses, or universities with password patterns.

The default model is anthropic/claude-opus-4.6. If a refusal response is returned, moonshotai/kimi-k2 and google/gemini-2.5-flash are tried in order. The temperature is kept at 0.2, no SDK is used, and requests are sent as hand-built JSON. Talos interprets the low temperature as a pursuit of accuracy and the chain as a fallback from refusing models to smaller and more flexible models. The malware checks for refusal patterns such as “I can’t” and moves along the chain; if there is no API key, it still works without the AI stage. Inference is completed on the victim’s own machine and over their own connection, with only the result leaving the system.

A commercial product compiled from a template

VOLTA is compiled not with fixed values but with a template that has six mutable fields: the Telegram channel, API keys, and settings are filled in on the buyer’s side. Talos reads this as a business model in which the author sells access and a separate binary is compiled for each order. If that is true, the AI file is a commercial feature that lets even buyers with limited technical knowledge receive a ranked target assessment. The credentials in the template are encrypted with a key derived from the SHA-256 digest of two constants in the same file; Talos says this does not provide meaningful protection.

What users should do

Much of the token theft relies on bypassing Chrome’s App-Bound Encryption protection. Talos notes that an application control policy restricting which processes can launch Chrome with the headless flag would close this path completely. At a minimum, it recommends generating an alert when Chrome starts headless from an unexpected process and using hardware-backed credential storage.

After an attack, the volta_debug.txt file should be preserved, potentially compromised tokens should be revoked, and passwords should be changed. A wallet seed phrase sitting in plaintext on disk should be considered fully compromised; funds should be moved to a new wallet whose seed was generated on an air-gapped device.

According to Talos, what the AI layer adds is not speed or scale but a shift in labor. The research says that as AI becomes more common in malware, resilience to refusal responses may become a standard design requirement.

Source: Unite.AI