Security researchers at Cisco Talos have uncovered a new Windows infostealer that uses commercial AI models to automatically profile its victims and rank their assets by how much they are worth. The malware calls itself "Volta-Autodoxer," and the findings were shared with WIRED's Kernel Panic newsletter before publication on October 31, 2026.
Unlike ordinary stealers that simply dump stolen passwords into a file, Volta builds a structured dossier on each victim, then sends it to large language models for analysis. Talos researcher Ryan Fetterman described it as a prioritization and analysis function that lets attackers quickly surface their highest-value targets.
How Volta-Autodoxer uses LLMs
Volta sends a serialized evidence bundle to OpenRouter, which can route prompts to several AI providers. The malware defaults to Anthropic's Claude Opus 4.6, but if the model refuses, it fails over to a chain of up to three models, checking each response for phrases like "I can't" before moving on.
"The prompt is pretty carefully crafted not to imply anything overtly malicious," Fetterman told WIRED. The operators also built in the expectation of hitting model guardrails, which suggests a deliberate engineering effort rather than a one-off experiment.
- Default model: Anthropic's Claude Opus 4.6
- Fallback chain: Moonshot AI's Kimi K2, then Google's Gemini 2.5 Flash
- Temperature hardcoded at 0.2 for consistent, deterministic output
- Requests sent through OpenRouter, a service that routes prompts to multiple AI providers
