Volta malware raids your Gmail receipts, then asks an AI what you're worth

A newly documented piece of Windows malware hands its loot to an AI chatbot and asks for a written verdict on the person it just robbed. Called Volta-Autodoxer, it grabs saved passwords, cookies, payment cards and crypto wallets, then sends a dossier to a large language model with an instruction to rank “what they’re worth.” For anyone whose life runs through a browser, that turns a pile of stolen logins into a shortlist of who to rob first.

The research comes from Cisco Talos, which flagged the malware with a new framework built to catch hacking tools that call AI models, and Wired first reported it. The theft itself is familiar. The second pass is not. Using the victim’s own stolen sessions, Volta searches their Gmail for receipts from Amazon , DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a address, pulls food-delivery order history, fills out the victim’s Discord profile and even prices their Roblox inventory through a live lookup.

All of that becomes a structured evidence bundle, sent through OpenRouter, a service that relays prompts to many AI providers. The default model is Anthropic ’s Claude Opus 4.6. The prompt, 240 words long, casts the model as “a forensic intelligence analyst drafting a target assessment” and asks for a section on what the victim is worth, with valuables ranked by how easily they turn into money, and another grading their security habits. It tells the model to “connect dots across fields,” for example by noticing that a Wi-Fi password matches a surname, and to “go deep, not wide.”

The authors expected some chatbots to say no. Volta scans each for phrases such as “I can’t” or “I’m not able” and, after a refusal, retries with Moonshot AI’s open-weight Kimi K2 and then Google ’s Gemini 2.5 Flash. “The prompt is pretty carefully crafted not to imply anything overtly malicious,” Ryan Fetterman, the Talos researcher behind the analysis, told Wired. “But they’re building in the expectation to potentially hit model refusals at first request.”

The payoff for criminals is speed. Session tokens expire and people change passwords, so whoever works out first which victim holds a full crypto wallet or a company cloud key gets to use it. “We’re seeing more advanced capabilities accessible to lower-level sophistication attackers,” Fetterman said. Talos also found that Volta is built like a product: each copy has six slots for a buyer’s own Telegram channel and API keys, filled in when the file is compiled. That points to an author who sells the tool to other criminals, who then receive ranked target reports straight in their Telegram inbox.

The alarm has limits. Talos says it did not track whether Volta has been used against real victims, and the AI step is optional: without an API key, the malware still steals everything and simply skips the dossier. Underneath, it is a conventional Windows stealer, so the usual defenses still work. The shops it checks for receipts are almost all American, a hint whom its builders had in mind, though stolen passwords and wallets are worth the same anywhere.

For anyone hit, the advice from Talos is blunt. Revoke active sessions and tokens, change passwords, and treat any crypto wallet whose recovery phrase sat in a plain file on the computer as lost, moving the funds to a new wallet created on a device that has never been online. Infostealers often travel inside pirated or counterfeit software, so the cheapest protection is still not running it.

Talos published its analysis on October 31, two days after describing NIK C2, another criminal toolkit with AI built in. Researchers at CrowdStrike recently told Wired they had seen four hacking groups, working in Chinese, Spanish and English, Indonesian and Russian, using AI tools against dozens of targets around the world.

Talos says the open question for defenders is which part of a criminal operation gets handed to a model . With Volta, it was the part where a person used to sit and decide whom to rob.

Meta’s AI Reset Instagram Passwords for Hackers Who Just Asked

What is a botnet — and why your router may already be in one

Alibaba’s Qwen AI promised no tools, then tried uploading to Beijing

Copilot Gets Control of Windows and Your Files as Microsoft’s Recall Bill Comes Due

An AI wrote a working zero-day exploit — Google caught it first

ChatGPT Work: OpenAI merges ChatGPT and Codex into one agent that never clocks out