This new Windows malware steals all your data, then uses AI to rank how valuable you are as a victim
Sifting through a mountain of data is tedious work
by https://www.techradar.com/author/sead-fadilpai · TechRadarNews By Sead Fadilpašić Published 2 November 2026
Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter
- New malware uses AI to analyze stolen data, rank victims, and identify the most profitable targets
- VOLTA-AUTODOXER steals credentials, crypto wallets, tokens, and personal information before generating AI dossiers
- Researchers warn the malware could commoditize AI-powered victim profiling for ransomware and cybercrime operators
Stealing sensitive data from a lot of people is one thing, but determining whether or not that data is worth anything to anyone - that’s an entirely different ball game.
Now, it seems cybercriminals found a way to easily profile their victims’ information and they’re using - you guessed it - Artificial Intelligence (AI).
Cybersecurity researchers Cisco Talos uncovered a new malware strain through Cognitive Artificial Intelligence Research Network (CAIRN) - an open source cybersecurity research kit built to identify and track AI-powered malware.
Latest Videos FromTechRadarWatch full video here:
The strain is called VOLTA-AUTODOXER and its operation is split into four key steps: 1) steal as much information as possible; 2) share it with an AI for assessment; 3) exfiltrate the data to attacker-controlled infrastructure; and 4) remove yourself from the victim’s system.
Analyzing the data
Cisco Talos did not say where exactly the malware was found, how many devices it infected, or how it is being disseminated. It said that, on surface level, it looks just like any other infostealer. It grabs browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots.
But this is where it splits from the industry standard, by building a structured evidence bundle about the person behind the system.
It pulls the device’s geographical location, home address, employer and employer domain, inferred birth year, the last 4 digits of their credit cards, Slack workspaces, document authorship metadata, iPhone backup indicators, and even a live Roblox account valuation. Then it moves to Gmail, looking for mails from UberEats and DoorDash in order to confirm the home address.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors