The Malware Does Not Doxx You. It Asks an AI How Much You Are Worth.

Cisco Talos published its analysis on 31 October 2026. The malware names itself VOLTA-AUTODOXER: a self-deleting Windows binary, PE32+ x86-64.

Talos summarised the design behind it plainly: "cast a wide net, steal everything, and let AI sort out the specifics."

It has not been seen in a real attack. Talos observed no in-the-wild use and a researcher told WIRED the sample appears to be a working prototype rather than something circulating widely. The AI stage is also optional, skipped entirely when no API key is present, which leaves a capable but ordinary infostealer.

That matters in both directions. It means nobody is known to have been hurt yet. It also means defenders have indicators, file paths and strings published before anything is circulating, which is a rare position to be in.

How the dossier is built

The harvesting is broad but conventional:

Session tokens matter more than passwords here. They are bearer credentials: whoever holds one is treated as the user, with no login to challenge and no multi-factor prompt to satisfy.

Then VOLTA does something new. Instead of dumping credentials for a human to sift, it enriches what it stole to work out who the victim actually is:

• Uber Eats and DoorDash order history, which gives home address, routine and spending

• The victim's own stolen Discord token, reused to pull their profile and turn a credential into biography

• A live valuation of their Roblox inventory, looked up on Rolimons.com

The result is written to Identity_Report.txt, whose first line reads TARGET ASSESSMENT, then serialised as JSON. Reporting indicates the bundle carries geolocation and home address, employer and employer domain, inferred birth year, payment card last four digits, Slack workspaces and that Roblox valuation.

That is not a credential dump. It is a dossier, and it is assembled for a different crime: doxxing, harassment, sextortion and targeted extortion rather than card fraud.

The AI stage, and the failover chain

VOLTA posts the bundle to OpenRouter, a service that fronts multiple AI providers, and asks a model to rank the victim's assets by monetisation value. The default is Anthropic's Claude Opus 4.6.

If a model refuses, VOLTA falls through a chain: Claude Opus 4.6, then Kimi K2, then Gemini 2.5 Flash. The debug log even carries the string [dox] ai: %s refused/thin, next model. Talos reads that design as implying deliberate engineering and an expectation of hitting model guardrails.

The chain is evidence in both directions, and both are worth stating:

• Refusals happen. Nobody builds a failover for a problem they have not encountered.

• Refusals do not protect the victim. Where one provider declines, the next may not. A safety measure routed around with three lines of configuration redistributes the request rather than stopping it.

Talos notes that nothing in the sample suggests any AI model helped write the malware. This is malware using AI as a tool, not malware authored by one.

Hunting for it

Artefacts and strings

• %APPDATA%\volta_debug.txt, an archive named volta_doxnet.zip, and Identity_Report.txt

• Plaintext VOLTA-AUTODOXER and VOLTA AUTODOXER, plus the report header TARGET ASSESSMENT

• Log strings [dox] ai: %s refused/thin, next model and [dox] ai: flag on but no key, which show the AI stage ran or was attempted

Network

• Outbound connections to OpenRouter from endpoints with no business reaching an AI routing service

• Lookups to Rolimons.com from user machines, unusual outside gaming

If you find it

1. Preserve volta_debug.txt before cleaning. It records what was collected and whether the AI call succeeded, which tells you how much of the dossier actually exists.

2. Revoke tokens, do not just reset passwords. Discord, Telegram, Steam, Roblox and Microsoft OAuth sessions survive a password change.

3. Rotate SSH keys and cloud credentials present on the machine, and rebuild rather than clean it.

4. Treat the dossier as part of the incident. If an evidence bundle was assembled, the person's home address, employer and personal details may exist as a package built for harassment. That needs a conversation with them, not just a ticket.

Treat any infostealer infection as an identity incident rather than a malware incident, as with the GhostAction and ConnectWise cases. The machine is the symptom. The credentials are the problem.

Why victim triage is the real change

The hard part of mass credential theft was never the stealing. It was the reading.

Infostealer operators drown in logs. Most are never examined, because triaging them by hand is slow and most victims turn out to be worth nothing. A victim whose data would have sat unread in a dump now gets a score, and that changes who gets pursued.

Everything else in VOLTA is ordinary. Browser passwords, cookies, cards, seed phrases, tokens. The enrichment is clever and cheap rather than sophisticated: reusing a stolen Discord token to query that person's own profile costs nothing, and delivery order history is a reliable way to find where someone lives.

What is new is the step that turns an undifferentiated pile into a sorted queue. AI did not make this attack more capable. It made the attacker's workflow scale, which is a smaller claim and a more consequential one.