This new Windows malware steals all your data, then uses AI to rank how valuable you are as a victim

Date:
Mon, 02 Nov 2026 17:05:00 +0000

Description:
Sifting through a mountain of data is tedious work - so why not let AI do it for you?

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter New malware uses AI to analyze stolen data, rank victims, and identify the most profitable targets VOLTA-AUTODOXER steals credentials, crypto wallets, tokens, and personal information before generating AI dossiers Researchers warn the malware could commoditize AI-powered victim profiling for ransomware and cybercrime operators Stealing sensitive data from a lot of people is one thing, but determining whether or not that data is worth anything to anyone - thats an entirely different ball game.

Now, it seems cybercriminals found a way to easily profile their victims information and theyre using - you guessed it - Artificial Intelligence (AI). Cybersecurity researchers Cisco Talos uncovered a new malware strain through Cognitive Artificial Intelligence Research Network (CAIRN) - an open source cybersecurity research kit built to identify and track AI-powered malware. Latest Videos From TechRadar Watch full video here:

The strain is called VOLTA-AUTODOXER and its operation is split into four key steps: 1) steal as much information as possible; 2) share it with an AI for assessment; 3) exfiltrate the data to attacker-controlled infrastructure; and 4) remove yourself from the victims system. Analyzing the data Cisco Talos
did not say where exactly the malware was found, how many devices it
infected, or how it is being disseminated. It said that, on surface level, it looks just like any other infostealer. It grabs browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots. You may like Rogue AI agent engages 'Skynet mode' to search the internet for exposed LLMs to hijack and run malware attacks NordVPN warns AI is making scams more personal and devastating than ever Massive Chinese hack uses AI agents to steal over 600,000 credit cards and hit hundreds of sites with malware

But this is where it splits from the industry standard, by building a structured evidence bundle about the person behind the system.

It pulls the devices geographical location, home address, employer and employer domain, inferred birth year, the last 4 digits of their credit
cards, Slack workspaces, document authorship metadata, iPhone backup indicators, and even a live Roblox account valuation. Then it moves to Gmail, looking for mails from UberEats and DoorDash in order to confirm the home address. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

VOLTA then bundles and serializes the bundle, before POSTing it to
OpenRouter, an AI infrastructure platform where users can access hundreds of LLMs through a single API.

There, the AI gives a model a prompt to behave as a forensic intelligence analyst drafting a target assessment. In other words, the AI is tasked with assessing whether or not the data pulled is worth any trouble, and if so -
how much. Victims are ranked by value, giving the attackers more time to do what seems to be the end goal here - ransomware.

The default model is Claude, but if it refuses to comply for any reason, the malware is instructed to fall back to Moonshot AIs Kimi K2 and Google s
Gemini 2.5 Flash. If neither of the models end up working, the malware will just send raw data back to the attacker. This is usually done via a Telegram channel. What to read next Chinese hacker hits over 100 company websites
using AI agents Deere and SharkNinja among top brands affected in attack A new cybercrime campaign uses fake AI apps with real-sounding names to infect people curious to try the newest tools This Halloween, make sure your sensitive data Is wearing a mask Running away After the work has been completed, VOLTA is instructed to delete itself from the system, likely to cover its tracks. A separate file, named volta_debug.txt apparently remains
on the system, showing what was collected and whether or not the AI-powered assessment was a success.

The researchers believe VOLTA is designed to be sold on the black market. Elements such as the Telegram channel, or API keys, are not hardcoded, and
the malware comes as a template with six swappable slots that are filed in at build time.

This suggests its a builder model: The author sells access, the customer provides their values, and the builder compiles a custom binary for each order, Cisco Talos explains. If VOLTA is indeed a commoditized malware, then the AI dossier capability isn't something the author invented for their own operations. It is a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments in their Telegram inbox.

If you suspect an infection, revoke or rotate all API keys and tokens, and change all of your passwords. Also, double-check your crypto wallets and move all funds to a new wallet with a fresh seed. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/this-new-windows-malware-steals-all-you r-data-then-uses-ai-to-rank-how-valuable-you-are-as-a-victim


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)