The Claude logo. Image: Anthropic
A newly found strain of infostealer malware doesn’t stop at emptying a victim’s passwords and crypto wallets. It packs everything it has learned about the person into a file, hands it to Anthropic’s Claude and asks for a written assessment of what they are worth. Cisco Talos published its analysis of the malware, VOLTA, on Saturday.
The Windows stealer calls itself “VOLTA-AUTODOXER” internally and deletes itself after it runs. Talos found it through CAIRN, its new research effort to catch malware with AI built in. The sample Talos analysed was first seen on October 11, and Talos researcher Ryan Fetterman told Wired’s Kernel Panic newsletter that the team did not track whether VOLTA has been used in the wild.
What VOLTA steals, then goes back for #
The first sweep is a thorough stealer haul: browser passwords, cookies and saved cards, Microsoft OAuth tokens, crypto wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, cloud-provider keys and every saved Wi-Fi password.
Then it goes back for more, using the sessions it has just stolen. With the victim’s own Gmail access it searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address. It pulls order history from stolen Uber Eats and DoorDash sessions and prices the victim’s Roblox items through a live lookup on the trading site Rolimons. The result is a profile with a home address, employer, inferred birth year and the last four digits of their cards.
A “target assessment” from Claude #
That bundle is sent as JSON to OpenRouter, a service that passes requests on to models from many AI companies. VOLTA’s default is Claude Opus 4.6, at a low temperature of 0.2 for consistent answers. Its system prompt casts the model as “a forensic intelligence analyst drafting a target assessment from a structured evidence bundle” and asks for ten sections, including “WHAT THEY’RE WORTH”, which ranks crypto, Roblox account values, cards and accounts by a low, medium or high value tier, and “THEIR OPSEC”, on password hygiene, two-factor login and privacy tools.
The prompt tells the model to “connect dots across fields”: a Wi-Fi password that matches a surname, or a school’s learning platform that matches a .edu email address. “Go deep, not wide,” it says, and “Be blunt, specific, accurate.” The answer is sent back to the attacker with the identity report, and the AI call runs from the victim’s own machine.
‘They plan for failover’ #
VOLTA’s authors expected to be turned down. The malware checks each reply for phrases such as “I can’t” or “I’m not able” and, if it finds one, tries Moonshot AI’s Kimi K2, then Google’s Gemini 2.5 Flash. Talos says the chain implies “a direct engineering effort and expectation of hitting model guardrails”. Its report doesn’t say how any of the three models actually responded. Fetterman told Wired:
The prompt is pretty carefully crafted not to imply anything overtly malicious. But they’re building in the expectation to potentially hit model refusals at first request. And so they plan for failover kind of cascading to more permissible models as they go down the chain.
Ryan Fetterman, Cisco Talos, to Wired
Without an API key the stealer simply skips the AI step. Anthropic, OpenRouter and Moonshot AI haven’t commented on the findings.
Built to be sold #
Talos thinks VOLTA is sold to other criminals rather than used by one group. Its Telegram channel, API keys and settings sit in six swappable slots filled in at build time, which suggests a builder that compiles a custom copy for each customer. That, Talos says, would let “a customer of any level of sophistication” receive ranked target assessments in their Telegram inbox. Fetterman told Wired:
We’re seeing more advanced capabilities accessible to lower-level sophistication attackers. It’s really interesting and disturbing.
Ryan Fetterman, Cisco Talos, to Wired
It follows Symantec’s report of a ‘Skynet mode’ agent that hijacks other people’s AI models and Microsoft’s finding that North Korea’s hackers now lean on AI at every step. Stealers have also been the main source of the stolen Claude and Gemini logins sold on the dark web.
Talos says blocking unknown processes from launching Chrome with --headless cuts off much of VOLTA’s token theft. Victims should keep the %APPDATA%\volta_debug.txt log, which records what was taken, revoke tokens, change passwords and move crypto to a new wallet.
Why it matters #
Stealers already collect far more than any criminal can sift by hand, and VOLTA hands that sorting job to a commercial AI model, with backups lined up in case one says no. As Talos puts it, there is a difference between a wide net and “a wide net that sorts itself”.
Sources: Cisco Talos; Wired (Kernel Panic), interview with Ryan Fetterman.