Cisco finds password-stealing malware that asks Claude which victims are worth the most

What Cisco found

Cisco Talos, the company's security research team, has described a Windows program that steals personal data and then uses a commercial AI model to judge what the haul is worth. As The SOFX Report reported, the malware calls itself VOLTA-AUTODOXER. An infostealer is a type of malware that quietly collects passwords, logins and other private data from an infected computer, and this one deletes itself after running.

The research was published on October 31 by Talos analyst Ryan Fetterman. His team treats the AI step as a replacement for a person: normally a human criminal would read through stolen material and decide which accounts deserve attention. Here a model does that reading.

From stolen files to a dossier

The theft itself is broad. Talos says VOLTA takes passwords, cookies and saved payment cards from browsers, along with crypto wallet recovery phrases, session logins for messaging and gaming services, Microsoft sign-in tokens, developer and cloud keys, saved Wi-Fi passwords and screenshots. When it finds a crypto wallet, it does not just copy the file. It runs a built-in password cracker against it.

Next it assembles a profile of the person. That profile covers their approximate location and home address, their employer, a guessed birth year, part of a card number, and the live value of items in a Roblox account. To firm up the picture, it uses the victim's already-logged-in sessions to search their email for shopping and food-delivery receipts that confirm where they live, and it pulls order histories from delivery apps.

All of this is packed into a structured file and sent through OpenRouter, a service that forwards requests to different AI models. The prompt tells the model to act as a forensic intelligence analyst and write a target assessment. The answer ranks the victim's valuables by how much each could sell for and grades how careful the person is with passwords. The code sets the model's temperature, a dial for randomness, at a low 0.2 so answers stay consistent. The finished report is then sent out through Telegram in stages.

Designed to get past refusals

Most commercial AI models are trained to decline requests that look harmful. VOLTA is built around that. It reads each reply for signs of a refusal, and if it sees one, it moves down a list of up to three models: Anthropic's Claude first, then Moonshot AI's Kimi K2, then Google's Gemini 2.5 Flash.

Talos read this as a deliberate answer to AI safety guardrails and suggested that resilience against refusals may become a common feature in tools like this. If the buyer supplies no model key, the malware skips the AI step and still sends the raw stolen data over Telegram, so the AI layer is an add-on rather than a requirement.

This is not a story about Claude being unsafe for ordinary use. Sorting and summarizing messy information is the kind of skill that is useful to everyone, including people with bad intentions. The point is that a good general-purpose tool can be pointed at the wrong job.

A product, not a one-off

Talos judged that VOLTA is a kit made to be sold. The code has six swappable slots for things such as the Telegram channel, the model keys and other settings, which are filled in when each buyer's copy is built. All of its network traffic goes through third-party services, so there is no server owned by the attackers that investigators could seize.

Talos called the shift effort displacement: the model takes over analysis that an operator would otherwise do by hand. The team says it saw the same pattern in two other AI-connected tools this autumn.

There are limits to what is known. Talos analyzed a single sample, first seen on Oct. 11, and did not say whether anyone has been attacked with it.

What defenders and victims can do

Talos's advice for organizations is to limit which programs can launch Chrome in headless mode, meaning without a visible window. VOLTA uses that method to lift login tokens out of the browser.

For anyone who suspects an infection, Talos suggests saving the malware's debug log, changing exposed passwords and keys, and moving any cryptocurrency whose recovery phrase was stored as plain text.

For everyone else, the practical lesson is about ranking. If a thief's software is sorting accounts by value, your email and banking logins are the ones that matter most. Giving them their own unique passwords limits how much one stolen file can reveal.