New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely
A self-deleting Windows infostealer called VOLTA-AUTODOXER steals data from victims' PCs and uses Anthropic's Claude AI to assess which assets are most valuable before removing itself.
The malware operates by prompting Claude to act as "a forensic intelligence analyst" and to be "blunt, specific, accurate." It steals browser passwords, cookies, saved payment cards, email profiles, Roblox accounts, Microsoft OAuth tokens, screenshots, SSH and cloud-provider configuration files, and Wi-Fi passwords in plaintext.
Target Assessment
VOLTA then builds a structured "evidence bundle" containing geolocation, home address, employer information, inferred birth year, document metadata, and payment card details. For cryptocurrency wallets, the malware attempts to crack their vaults inline rather than just copying them.
Adaptive Approach
What makes VOLTA particularly concerning is its adaptive capabilities. If one AI model refuses to cooperate, the malware can switch to another or bypass the AI step entirely. After completing its assessment, the malware deletes itself, making detection more challenging for security researchers.
Related
