Your Uber Eats order history probably feels harmless. A new Windows infostealer treats it as evidence. It uses stolen session access to pull your delivery receipts, matches them against your Gmail purchase history to confirm where you live, then hands the whole file to an AI model and asks what you are worth to a criminal.
The malware calls itself VOLTA-AUTODOXER. Cisco Talos published its analysis on October 31, 2026, the same day Wired’s Kernel Panic newsletter reported it. This article explains what the malware does and what is still unknown. It also covers the practical steps that matter, since the AI layer changes who gets targeted first, not how the theft starts.
What is Volta-Autodoxer?
Volta-Autodoxer is a self-deleting Windows infostealer. After it steals credentials, sessions and crypto-wallet data, it sends a summary to a large language model (LLM). The model ranks the victim’s assets by how easily they can be turned into money.
Talos describes it as a mature stealer with an optional AI layer added at the end. The core theft is conventional. What is new is that an AI model does the triage that a human criminal would otherwise do, such as deciding which stolen accounts are worth the effort.
At a glance: what is confirmed and what is not (as of November 1, 2026)
| Question | Answer |
|---|---|
| Who found it? | Cisco Talos, through its CAIRN research effort for tracking AI-integrated malware |
| Which systems? | Windows (Talos describes a PE32+ x86-64 executable) |
| Is the AI part required? | No. Talos says it can run without the AI stage if no key is present |
| Is it confirmed in real attacks? | Not established. Talos researcher Ryan Fetterman told Wired the team had not tracked whether it is used in the wild, and the Talos report cites no confirmed victims |
| Did the attackers build their own servers? | Talos says all observed endpoints are third-party controlled, with no attacker-owned infrastructure |
| Does it publish victim data online? | Talos does not describe any public release. The output goes to the operator |
How does Volta-Autodoxer work?
It works in four stages: steal, enrich, analyze, send. Everything up to the AI call runs on the victim’s own machine.
- Steal. It sweeps the computer for browser passwords, cookies, payment cards, wallet seed phrases and app sessions.
- Enrich. It uses the stolen sessions to look up more about you. Talos says it searches the victim’s Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address. It also pulls food-delivery order history and enriches Discord accounts.
- Analyze. It writes everything into a local file called Identity_Report.txt and sends it to an AI model through OpenRouter, a service that routes requests to different model providers. The prompt tells the model to act as a forensic intelligence analyst writing a target assessment. The answer comes back as AI_Analysis.txt.
- Send. Both files leave the machine together in an archive named volta_dox.zip. Talos says exfiltration can happen in up to three stages, with separate archives after the theft, after the AI call, and after any extra network enrichment.
The AI request travels over the victim’s own internet connection, from the victim’s own computer, before the result is sent out. That is a small detail with a practical consequence for defenders, covered below.
What does it steal?
Talos lists the haul in some detail. The table groups it by what a criminal can do with each item.
| Category | What Talos says it collects |
|---|---|
| Browser data | Saved passwords, cookies and payment cards from Chromium-based browsers, plus Firefox and Thunderbird data |
| Account sessions | Discord, Telegram, Steam, Battle.net and Roblox sessions; Slack workspaces; Outlook profiles; Microsoft OAuth tokens |
| Money | Cryptocurrency wallet data, including seed phrases, plus an embedded cracker that attacks wallet vaults |
| Infrastructure access | SSH keys and cloud-provider configuration files |
| Local network | Every saved Wi-Fi password, dumped in plain text |
| Profile details | Geolocation, home address, employer, inferred birth year, card last-4 digits, document authorship metadata, iPhone backup indicators |
| Extras | Screenshots and a live valuation of Roblox inventory through a public lookup site |
What most people miss: the sign-in session matters more than the password. Gmail access lets the malware search your receipts, and delivery-app sessions let it read your order history. A stolen session is a live key to everything the account can see.
What does “autodox” actually mean here?
It means the malware builds a dossier on you automatically. It does not mean it posts your details publicly. Doxing in the usual sense is exposing someone’s personal information. Here, the dossier goes to the person running the malware, who Talos says receives ranked target assessments in a Telegram inbox.
That distinction matters because it changes the risk. The point is to help a criminal decide whether to drain a wallet, resell a Discord account or take over a work login, and in what order.
| Term | What it is | Related to Volta? |
|---|---|---|
| VOLTA-AUTODOXER | The malware’s self-chosen name, per Talos | Yes |
| Kernel Panic | Wired’s security newsletter that broke the story | Only as the publisher |
| A kernel panic | An operating-system crash error | No, despite searches showing both |
| CAIRN | Talos’s open research toolkit that spotted the sample | Discovery tool, not malware |
| CLOSEDQUORUM | A separate AI-enabled implant Talos has written about | Same research theme, different malware |
Why does the malware keep switching AI models?
It expects some models to refuse. Talos says the code checks each response for refusal phrases such as “I can’t” or “I’m not able,” then moves to the next model. The hardcoded chain starts with anthropic/claude-opus-4.6, then moonshotai/kimi-k2, then google/gemini-2.5-flash. Talos reads that as the author anticipating guardrails and planning around them.
Two details from the Talos report help keep this in proportion:
- The model is a tool the operator calls with their own API access. Talos does not describe any model being hacked or compromised.
- The temperature is set low, at 0.2, which Talos reads as a push for consistent, accurate output rather than creative text.
Talos also notes the prompt asks the model to draw connections across sparse data, such as links between someone’s name, address or university and their password habits. The model is not finding new data. It is stretching what was already stolen.
Is it being used in real attacks?
Nobody has publicly shown that. Talos did not track real-world use, and its report cites no confirmed victims. The sample’s file timestamp is August 17, 2026, and Talos lists its first sighting as October 11, 2026.
The structure of the code suggests it is built to be sold. Talos found a template with six swappable slots, including the operator’s Telegram channel and API keys, filled in when each copy is compiled. Talos reads this as a builder model, where a customer supplies their own values and gets a custom binary. If that is right, the AI dossier feature is a product feature available to any buyer, not a tool for one skilled crew. Talos frames that as an inference, not a proven fact.
| Date | Event |
|---|---|
| Sept 22, 2026 | Talos releases CAIRN, a toolkit for tracking AI-integrated malware |
| Aug 17, 2026 | Compile timestamp on the Volta sample |
| Oct 11, 2026 | First sighting of the sample, per Talos |
| Oct 31, 2026 | Talos publishes its VOLTA analysis; Wired reports it |
Who should worry most?
Windows users who sign in to many services from one browser carry the most exposure, because that is exactly what this malware harvests. People with crypto wallets, gaming and chat accounts, or work logins stored on the same machine have the most to lose. Talos describes only a Windows build, so this report is not evidence of a Mac or phone version.
The risk is lower if your sensitive accounts live on a separate device, or if you use hardware-backed security for logins and wallets. It is not zero for anyone, because the malware targets the machine you actually use.
How do you reduce your risk?
The AI layer does not change how infection starts, so the basics still matter most.
- Avoid the delivery routes. Talos’s report does not say how VOLTA is delivered. Other infostealer campaigns reported this year spread through fake AI video tools and fake GitHub repositories, so treat unofficial installers and cracked software as the main danger.
- Keep Chrome updated. Google made Device Bound Session Credentials generally available on Windows in Chrome 146 in April 2026, and reporting since then describes the rollout widening. The feature ties a session to a key held on your device, so a stolen cookie becomes much less useful. It depends on the websites you use supporting it, and it does not stop the infection itself or help with data already stolen.
- Never keep a wallet seed phrase as plain text on your PC. Talos says that if a seed phrase was in plaintext on disk, treat the wallet as fully compromised.
- Use hardware-backed credential storage where you can. Talos recommends it.
- Sign out of sessions you no longer use. This is general good practice, not a Talos recommendation. A session you have ended cannot be reused.
- For IT teams: Talos says much of the token theft depends on bypassing Chrome’s App-Bound Encryption, and that restricting which processes may launch Chrome with the –headless flag would block that path. Alerting on that launch pattern from unexpected processes is the fallback. As an illustrative extra, since the AI call goes out from the infected machine, unexpected traffic to openrouter.ai from endpoints that have no reason to use it could be worth a detection rule. Talos does not make that specific recommendation.
If you use AI tools that hold your accounts, the same logic about access applies there. Our explainer on how AI coding agents differ from chatbots covers who holds the keys in each case. The same questions about permissions come up in agentic Windows features and access control and in our guide to Meta’s Muse personal agent.
What should you do if you think you are infected?
Move fast and work from a device you trust. The sequence below combines Talos’s guidance with US government consumer advice.
| Step | Why | Source of the advice |
|---|---|---|
| Look for %APPDATA%\volta_debug.txt and keep it | It is a timestamped log of what was collected and whether the AI call worked. The main program deletes itself, so this may be the only trace | Talos |
| Revoke tokens and sessions, then change passwords from a clean device | Stolen sessions and passwords remain usable until you do | Talos |
| Move crypto to a new wallet with a fresh seed | A seed that was exposed stays exposed | Talos |
| Freeze your credit at Equifax, Experian and TransUnion | A freeze is free to place or lift, does not affect your score, and lasts until you lift it | FTC |
| Report identity theft at IdentityTheft.gov | You get a free recovery plan and a report | FTC |
If the log file is missing, treat that as inconclusive. Talos does not say what an absent file means, and a clean-looking folder does not prove a clean machine.
Myth vs fact
| Myth | Fact |
|---|---|
| The malware needs AI to work | Talos says it runs without the AI stage if no key is present |
| An AI company was breached | Talos describes the models being called as paid services, not compromised ones |
| “Autodox” means your data is posted publicly | Per Talos, the dossier goes to the operator, not to a public site |
| Multi-factor authentication makes you safe | MFA protects the login step. A stolen active session can sidestep it, which is the problem Chrome’s session-binding feature targets |
| It is already infecting thousands | No public evidence of that as of November 1, 2026 |
FAQs
Is Volta-Autodoxer confirmed in the wild?
Not publicly. Talos told Wired it had not tracked real-world use, and its report lists no confirmed victims. Defenders still treat samples like this seriously because the stealer itself is described as mature.
Does it work on Mac or phones?
Talos describes a Windows executable. Nothing in the report points to a Mac, Android or iPhone version, though it does look for iPhone backup indicators on Windows machines.
Which AI models does it call?
Talos reports a default of anthropic/claude-opus-4.6, falling back to moonshotai/kimi-k2 and then google/gemini-2.5-flash, all through OpenRouter. The report does not say whether any provider has taken action.
Is this the same as doxing?
Close, but not identical. Doxing usually means publishing someone’s personal information. Here the malware compiles a private dossier for a criminal’s own use.
Can someone buy this?
Talos infers it may be sold as a builder, given the six-slot template. That is an inference from the code’s structure, not a confirmed sales listing.
What is the single most useful step today?
Update Chrome and Windows, move any wallet seed phrase off your PC, and sign out of accounts you no longer use. Then freeze your credit if you handle financial accounts on that machine.
Conclusion
Volta-Autodoxer is an ordinary infostealer with an unusual last step. An AI model decides which stolen assets are worth chasing. Talos has not shown it hitting real victims, but the design shows where criminal tooling is heading: using models to remove work from the human operator.
Key takeaways:
- The AI layer is optional, and the theft starts the same way it always has.
- Sessions and tokens are the real prize, not just passwords.
- No wallet seed phrase should sit as plain text on a PC.
Your next step: check that Chrome is up to date and search your computer for any plain-text file holding a wallet seed phrase. Move it somewhere safe today.
Related: How AI coding agents differ from chatbots
Disclaimer: This article is for informational purposes only and is not affiliated with, sponsored by or endorsed by Cisco, Talos, Wired, Google, OpenRouter, Anthropic or any other company mentioned. Security findings, product features and guidance can change, and this information was last verified on November 1, 2026. This is not professional security, legal or financial advice. If you believe you have been compromised, contact a qualified security professional, and remember that AI output can be inaccurate.