Safety · 2026-11-02

New Windows Virus Steals Data and Asks Claude to Estimate How Much the Victim Is Worth

Cisco Talos researchers found a malicious program that steals passwords and personal data from a computer and then uses AI to judge how valuable the victim is to criminals.

✨ What happened

Researchers at Cisco Talos discovered a new threat for Windows. It is an infostealer called VOLTA-AUTODOXER, which steals information stored on a computer. What makes it especially dangerous is that it sends the stolen data to an artificial intelligence model, which estimates the financial value of the person.

After running, the program deletes its own executable file, so it becomes harder to find on the computer.

📌 What it steals

According to Tom's Hardware, the virus collects passwords saved in browsers, cookies, saved bank cards, Outlook and Thunderbird correspondence, Microsoft and Discord sign-in tokens, cloud and SSH configuration files. It also extracts Wi-Fi passwords and tries to break into cryptocurrency wallets.

With the stolen sessions, the program can look through email, including receipts from well-known services. This way, criminals can learn a person's home address, workplace, and date of birth.

🔹 How AI becomes part of the attack

The virus sends the collected data to a language model through the OpenRouter service. By default it uses Claude Opus 4.6 from Anthropic. The program asks the model to act as a "forensic intelligence analyst" and estimate which of the victim's assets could be quickly sold or monetized.

If one model refuses, the virus tries Kimi K2 from Moonshot AI and then Gemini 2.5 Flash from Google. If no model works or the API keys are missing, the data is simply sent to the attackers via Telegram without AI evaluation.

🔸 How to protect yourself

Experts advise paying attention to suspicious programs, especially those that start on their own or run in the background. If you suspect your computer is infected, you should:

— immediately change all passwords and API keys;

— end active sessions in all services and revoke access tokens;

— move cryptocurrency to new wallets, and create recovery phrases on a separate device that is not connected to the infected computer.

Sources: 🔗 DOU/dev.ua