Volta-Autodoxer AI Malware Steals 8 Data Types to Rank Your Wealt

Security experts at Cisco Talos have found a new Windows malware named Volta-Autodoxer. It steals files from your PC and uses AI to study your wealth. Researcher Ryan Fetterman shared the report on October 31, 2026. The tool grabs eight types of user data and builds a full target report.

Most spyware just dumps raw passwords onto a hacker server. Volta-Autodoxer goes a big step further. It sends stolen records through OpenRouter to three major AI models. It uses Claude Opus 4.6, Kimi K2, or Gemini 2.5 Flash to rank each victim by cash value.

How 3 AI Models Rank 8 Stolen Data Types in Seconds

The Cisco Talos research report makes one key fact very clear. The AI model does not break into your computer. Instead, a regular Windows virus steals the files first. Then, the AI reads those files and picks out the richest victims.

The malware sample was built on August 17, 2026. Experts first saw it online on October 11, 2026 at 12:46 UTC. After pulling files from a PC, the tool saves a text file called Identity_Report.txt. It sends this file to OpenRouter with a 240-word prompt set at 0.2 temperature.

In AI tools, a 0.2 temperature forces the bot to give strict, factual answers. It stops the model from making wild guesses. The prompt tells the AI to list "WHAT THEY'RE WORTH" by ranking assets as low, medium, or high value. It also grades "THEIR OPSEC" by checking if the user reuses weak passwords.

1. Saved Web Passwords, Login Cookies, and Bank Cards

Volta-Autodoxer starts by raiding web browsers like Google Chrome, Microsoft Edge, Brave, and Firefox. It copies saved usernames, passwords, and payment cards stored for fast checkout. This gives hackers quick access to shopping, email, and bank sites.

Even worse, the malware steals active browser cookies. A cookie keeps you logged into a site so you do not have to type your password each time. With a stolen cookie, a hacker can step right into your active account and skip two-step login codes.

2. Chat Apps, Gaming Accounts, and Work Login Tokens

Next, the malware hunts for open sessions in chat and gaming apps. Cisco Talos found that it targets Discord, Telegram, Steam, Roblox, and Battle.net. It even pulls extra user details straight from stolen Discord sessions.

The tool also steals workplace login keys. It grabs Microsoft OAuth tokens and Slack workspace files from the PC. If you work from home, hackers can use these keys to read company chats and internal files.

3. Email Profiles and Online Shopping Receipts

An email inbox holds far more than just private letters. Volta-Autodoxer checks logged-in Gmail accounts as well as desktop apps like Outlook and Thunderbird. It searches your inbox for old order emails and receipts.

It looks closely for bills from Amazon, Walmart, and PayPal. A single shopping receipt shows your real name, phone number, home address, and what you buy. By reading dozens of receipts, the AI builds a clear map of your wealth and location.

4. Crypto Wallets, Vaults, and Recovery Seed Phrases

Crypto users face a huge risk from this malware. Volta-Autodoxer does not just copy wallet files off your hard drive. It also includes a built-in tool that tries to crack locked crypto wallet vaults right on your PC.

It searches text files for seed phrases, which are the master recovery words for self-custody wallets. Anyone with your seed phrase can drain your coins from anywhere. The malware also pairs crypto clues with the last four digits of your bank cards.

5. Food-Delivery Orders and Gaming Item Values

One strange feature of Volta-Autodoxer is how it tracks daily habits. It uses stolen login cookies to check order histories on Uber Eats, DoorDash, and Grubhub. It also scans Gmail for food bills.

Why do hackers care about what you eat? Frequent food orders confirm your exact home address, work address, and daily schedule. The tool even checks stolen Roblox accounts on a site called Rolimons to see how much cash your digital game items are worth.

6. Saved Wi-Fi Passwords and Home Location Clues

Your Windows PC remembers every Wi-Fi network you join. Volta-Autodoxer runs a built-in Windows command called WlanGetProfileList. This lets the malware dump all your saved Wi-Fi passwords in plain text.

Stolen Wi-Fi names and keys help hackers confirm where you live, work, and travel. If your family shares one home Wi-Fi password across phones and laptops, a single infected PC puts the whole home network at risk.

7. Work SSH Keys, VPN Setups, and Cloud Files

Volta-Autodoxer is a major threat to software builders and IT staff. It searches the hard drive for SSH keys, which tech workers use to log into remote company servers. It also grabs Google Cloud setup files.

In addition, the program steals VPN profiles from OpenVPN and Hide.me. It even logs your company name and work email domain. Hackers can sell this access to ransomware gangs looking to break into big firms.

8. PC Screenshots, File Author Names, and iPhone Backups

To finish the job, the malware grabs personal clues left across the system. It takes live screenshots of your desktop and reads author names saved inside Word and PDF files. It also checks if you keep local iPhone backups on your PC.

The tool even guesses your birth year by checking numbers used in your passwords. All eight data sets are combined into one file before the AI step begins.

How Headless Chrome and OpenRouter Bypass Safety Rules

Modern browsers try to block hackers from stealing cookies. Google Chrome uses a lock called App-Bound Encryption to protect your saved tokens. However, as reported by Tom's Hardware, Volta-Autodoxer beats this lock by opening Chrome silently in the background with the --headless command.

Next, the malware packs the stolen text into a JSON file and sends it to OpenRouter. It hides the request using a normal Mozilla/5.0 browser tag. Most AI models have safety rules that block illegal requests. So, the malware scans every AI reply for refusal words like "I can't" or "I'm not able."

If Claude Opus 4.6 says no, the malware hands the job to Kimi K2. If Kimi also refuses, it tries Gemini 2.5 Flash. If the hacker has no OpenRouter key, the tool skips the AI step and sends the raw files straight to Telegram.

"If you're able to identify your high-value targets faster, you probably have a better chance of using their credentials or authenticating using stolen tokens more often than maybe you would have if you had to do that triage yourself." — Ryan Fetterman, Security Researcher, Cisco Talos (via WIRED)

Readers should note one key fact. Public filings and security reports do not disclose any confirmed victim count or cash loss as of publication. As noted by The Indian Express, the tool has six empty setup slots. This shows it was likely built as a test model to sell to other cybercriminals.

The News4Bharat Perspective: Why Fast AI Sorting Threatens Indian Banks

On the dark web, raw stolen files sell for very little money. That is because hackers do not have time to read thousands of messy text logs by hand. Cisco Talos calls this new trick "effort displacement". Hackers now use cheap AI bots to do hours of detective work in a few seconds.

This creates a huge risk for India's banking and finance sector. Recently, over 20 financial firms faced cyberattacks in India. When an AI bot spots a bank manager or IT worker with live VPN keys, hackers can strike before those login tokens expire.

For Indian companies, home PCs are now the weakest backdoor into office networks. One infected home laptop used by a coder can hand hackers Slack access, cloud keys, and work passwords in a single zip file.

We already saw the danger of stolen enterprise data during the recent dark-web leak probe at Tata Electronics. At the same time, market firms under the SEBI FIRE cyber reporting rules must report breaches fast if stolen worker tokens lead to a hack.

What to Watch Next: 8 Steps to Lock Down Your Windows PC

Volta-Autodoxer deletes its main file (seen as 9BY0tjwOc3ut.exe or yLP9m5J3i2Aw.exe) right after it finishes stealing data. Because it wipes itself off the PC, users and IT teams must take clear steps to stay safe.

First, IT teams should block unknown apps from opening Chrome with the --headless command. Second, if you think a PC was hit, check the folder %APPDATA%\volta_debug.txt right away. That log file lists every stolen item and shows if the AI report worked.

Third, office firewalls should watch for strange data uploads to openrouter.ai/api/v1/chat/completions and Telegram bots. Fourth, remember that changing a password does not kill stolen cookies. You must open Gmail, Slack, and bank settings to click "Sign out of all devices."

Fifth, turn on two-step verification (MFA) for all email and money apps. Sixth, never keep work SSH keys or cloud files on a family gaming PC. Seventh, never save crypto seed phrases in text files on your computer. Eighth, if your PC gets infected, use a clean phone or second laptop to reset your passwords and move your crypto to a new wallet.

Frequently Asked Questions (FAQs)

Here are quick, simple answers to common questions about the Volta-Autodoxer AI malware and how to keep your Windows PC safe.

What is Volta-Autodoxer AI malware?

Volta-Autodoxer is a Windows virus found by Cisco Talos on October 31, 2026. It steals eight types of user files and uses AI models via OpenRouter to rank a victim's cash value and password safety.

Did hackers break into Claude, Kimi, or Gemini?

No. The AI models were not hacked and do not steal your files. The malware steals the files first and simply uses OpenRouter's API to read and rank the stolen text.

How does Volta-Autodoxer steal Google Chrome passwords?

The malware opens Google Chrome silently in the background using the --headless command. This trick bypasses Chrome's encryption lock and copies saved passwords, login cookies, and bank cards.

Has Volta-Autodoxer hit computers in India yet?

Public reports do not show any confirmed victim count in India or elsewhere as of publication. Cisco Talos noted that the malware looks like a test version built to be sold to other hackers.

What should I do if my PC gets hit by this malware?

Use a clean phone or second PC to change your passwords right away. Log out of all active sessions on Gmail, bank sites, and work apps. Move any exposed crypto to a brand-new hardware wallet.