VOLTA-AUTODOXER: New AI-Powered Windows Malware Targets Wealthy Users

A new Windows malware named VOLTA-AUTODOXER utilizes artificial intelligence models to evaluate the potential financial gain from compromising infected users. After harvesting available data from a compromised computer, the malware queries a Large Language Model to select the most lucrative and promising target for hackers.

• The malware defaults to Anthropic's Claude, switching to Kimi K2 or Gemini 2.5 Flash if the primary model refuses the prompt.
• VOLTA gathers geolocation, workplace domains, banking details, and actively attempts to crack discovered crypto wallets.
• The malware operates as a Malware-as-a-Service (MaaS) platform, generating customized executable files for individual attackers.

Operational Mechanics and AI Analysis

According to research from Cisco Talos, VOLTA employs a specialized system prompt that forces the artificial intelligence to act as an intelligence analyst. The LLM is required to provide a concise assessment of the victim's suitability, security posture, and password strength. If the default Claude model blocks the request, the malware seamlessly falls back to alternative models from Google or Moonshot AI.

Alongside text-based profiling, the malware aggregates a comprehensive victim data package. This dossier includes geolocation, home addresses, corporate domains, estimated birth years, document authorship metadata, and the last four digits of bank cards. Furthermore, any discovered cryptocurrency wallets are targeted with brute-force cracking attempts directly during the infection process.

MaaS Architecture and Security Bypasses

The VOLTA framework is structured as a Malware-as-a-Service model, allowing attackers to pre-configure Telegram channels, API keys, and other parameters to receive custom executable payloads. This setup frees buyers from managing complex backend infrastructure while delivering automated victim assessments straight to their messaging apps.

To bypass modern security mechanisms such as App-Bound Encryption in Google Chrome, the malware launches the browser in headless mode without a graphical interface. While application control policies can restrict such browser execution, they do not prevent broader data theft or block the integration of AI evaluation workflows.

What This Means for Users and Security

The emergence of such threats highlights a growing trend of weaponizing artificial intelligence to automate cybercrime and prioritize high-value targets. Attackers are increasingly relying on automated intelligence to sift through stolen data and focus on the wealthiest Windows users.

Once data collection is complete, the main malware executable may delete itself, but residual debug logs often remain on the compromised system. Affected users must immediately revoke and update all API tokens, change account passwords, and thoroughly audit their device security.