AI-Enabled Malware Profiles Victims to Help Criminals Assess Their Value

Information-stealing malware usually aims to grab passwords, payment details and other personal data. A newly identified Windows threat takes that idea a step further: it uses artificial intelligence to examine what it has collected and build a profile that could help criminals decide which victims or accounts may be most valuable.

The malware, called VOLTA-AUTODOXER, was analyzed by researchers at Cisco Talos. It can gather details from a computer, including browser passwords, payment information, login sessions, cryptocurrency wallet data and some work credentials. It then uses an AI service to organize the information and assess its potential value.

What the malware can find

VOLTA-AUTODOXER can collect saved Wi-Fi passwords, screenshots and information from applications such as Microsoft Outlook and Slack. Researchers also found that it attempts to crack cryptocurrency wallet vaults.

Some of its targets may seem surprisingly ordinary. The malware can search Gmail for receipts and use access to accounts such as Uber Eats and DoorDash to retrieve order histories. It may also look for receipts from services including Grubhub, Walmart, Amazon and PayPal. These records can help connect an online account to a person’s home address and identity.

Other details could offer clues about someone’s age, employer and online activity. Researchers found that the malware may examine Roblox accounts to estimate the value of virtual items. Any one piece of information might seem unimportant on its own. Put together, though, it can reveal much more about a person’s life and finances.

AI ranks the stolen information

After collecting data, the malware can send it to an AI model through the OpenRouter platform. The model is prompted to act like an intelligence analyst and prepare a report on the victim. One section, called “WHAT THEY’RE WORTH,” asks it to identify valuable assets and rate them as low, medium or high value. Another, “THEIR OPSEC,” looks at the person’s security habits, including password practices.

Researchers found that Claude is the default model. If it declines the request, the malware may try Kimi K2 from Moonshot AI or Google’s Gemini 2.5 Flash. It can then send the assessment to criminals through Telegram.

That setup could save attackers the time of manually sorting through large collections of stolen information. But the AI analysis is not required for the malware to work: it can still collect and send data if the analysis fails. And while researchers identified these features in the code, they have not confirmed that criminals have used the AI-generated rankings to choose real-world victims for further attacks.

What researchers know—and what they don’t

VOLTA-AUTODOXER may delete its main executable after finishing its work, which could complicate an investigation. However, it can leave behind a diagnostic file named volta_debug.txt. That file may record what was collected and whether the AI analysis succeeded.

The malware uses the infected computer’s internet connection to reach the AI service. Researchers also observed network connections to third-party services rather than infrastructure controlled directly by the attacker. That could make some activity less conspicuous, though it does not make the malware impossible to detect.

The code also suggests the malware may have been designed to be customized for different users. Cisco Talos has not confirmed that it is being sold, how many computers it has infected or how widely it has spread. Researchers first observed the analyzed sample on October 11, 2026, but have not identified a specific campaign distributing it.

For now, there’s no confirmed distribution method, so it’s better to focus on general precautions against information-stealing malware rather than assume it arrives through a particular message or download.

How to reduce your risk

Keep reputable security software running and up to date, and scan your devices regularly. Security tools that look for suspicious behavior as well as known malware may be useful against threats designed to hide or remove themselves.

A password manager can help protect passwords in an encrypted vault. Use a different, strong password for each important account so that one exposed password does not automatically put other accounts at risk. Still, a password manager cannot prevent every kind of theft: malware may capture active login sessions or information while you’re using your device.

Turn on two-factor authentication for email, financial accounts and other important services. Where available, consider passkeys or a hardware security key. If you think your device has been compromised, secure it and then sign out of existing account sessions; two-factor authentication alone may not stop someone who has already stolen a session token.

Install Windows and browser updates, and be wary of software from unfamiliar websites. Treat unexpected attachments and urgent instructions to install something with caution. Don’t paste commands into PowerShell, Command Prompt or the Run dialog just because a website says it will fix a problem. Similar tricks have been used to install information-stealing malware.

Because the malware can collect personal and financial details, review account activity, financial statements and credit reports regularly. A credit freeze with Equifax, Experian and TransUnion can help prevent someone from opening new credit accounts in your name. Data removal services may reduce the personal information listed by data brokers, though they cannot erase information already stolen from your device.

If you use your computer for work, avoid keeping sensitive access keys in unprotected files and follow your organization’s security rules. Report suspicious activity to your IT department. Cisco Talos also identified an attempt to bypass Chrome’s App-Bound Encryption protection; organizations may want their security teams to assess controls on which programs can launch Chrome in headless mode.

If you suspect your information has been stolen, act promptly—and don’t assume you’re safe just because a suspicious program has disappeared. VOLTA-AUTODOXER may remove itself after collecting data, while the stolen credentials could remain usable.

The findings offer a glimpse of how criminals might use AI to make stolen information easier to sort and exploit. Researchers have not established how common this malware is, but its design shows how ordinary digital records—receipts, account sessions and saved credentials—can become more revealing when analyzed together.