Windows Malware Weaponizes Claude to Evaluate Victims' Financial Worth Before Stealing
A self-deleting infostealer called VOLTA-AUTODOXER harvests personal data from infected machines and submits it to Anthropic's Claude to generate ranked assessments of victims' assets, according to Cisco's Talos research team.
Compromised email receipts and purchase histories from food-delivery services become the raw material for artificial intelligence-powered victim profiling. Cisco's Talos division has identified a Windows infostealer operating under the name VOLTA-AUTODOXER that exfiltrates data from compromised systems and leverages Anthropic's Claude—or alternative AI models—to generate what it terms a "target assessment" of each infected user. The malware constructs a detailed dossier and requests that the AI model rank the victim's possessions by their liquidation potential, effectively prioritizing which targets warrant further exploitation.
The malware operates with instructions directing the AI to function as "a forensic intelligence analyst" while remaining "blunt, specific, accurate." VOLTA-AUTODOXER includes built-in flexibility: if one AI model declines to process the request, the payload can attempt to switch to an alternative service or proceed without AI analysis entirely.
The infostealer's data collection scope spans browser-stored credentials, cookies, and payment card information, along with email account profiles from Thunderbird and Outlook, Roblox credentials, Microsoft OAuth tokens, system screenshots, and configuration files for SSH and cloud providers. The malware extracts all stored Wi-Fi passwords in unencrypted form. When cryptocurrency wallets are present on the system, VOLTA-AUTODOXER does not merely copy them; instead, it attempts to decrypt their contents directly on the infected machine. The resulting evidence bundle incorporates geographic location and residential address, employment information and corporate domain details, estimated birth year derived from available metadata, authorship information embedded in documents, and the final four digits of payment instruments.