Malware uses AI to rank victims before deleting itself

A new Windows malware called VOLTA‑AUTODOXER, reported by Cisco Talos, first appears to be an infostealer. It gathers passwords, cookies, saved payment cards, email profiles, Roblox accounts, and even SSH keys. The malware then packages the data into a text file and sends it to an AI model—by default Anthropic’s Claude—to get a list of the victim’s valuable items ranked by how much they could be cashed out. The whole process is done inside the victim’s own network, and the malware deletes its main executable after it finishes.

The AI request is made through a system prompt that asks the model to act as a forensic intelligence analyst. VOLTA‑AUTODOXER is tuned to produce blunt, precise answers and will switch to other models such as Moonshot AI’s Kimi K2 or Google’s Gemini 2.5 Flash if Claude refuses or gives a short reply. The model’s output is stored along with the evidence bundle and exfiltrated together in a zip archive that the malware deletes itself from the disk.

AI step that ranks assets

Separately, Check Point Research has identified a campaign named Yoba that lures victims with fake ChatGPT or Claude desktop apps. The installers bundle a genuine, digitally signed OpenAI or Anthropic Setup.exe next to a malicious DLL called winmm.dll. When the setup runs, the DLL sideloads, bypassing signature checks, and installs a dropper that later contacts a Telegram channel for commands.

The dropper, once elevated, copies a legitimate Windows Media Player binary into ProgramData, creates a scheduled task that runs as Local System, and downloads a payload from a Catbox file host via DNS over HTTPS. In the observed samples the final payload was the XMRig cryptocurrency miner, but the loader can retrieve other executables or PowerShell scripts, so the threat can evolve.

Defenders must look beyond simple file signatures. Indicators such as DLL loading by a signed executable, scheduled tasks that mimic Microsoft software, and unusual outbound connections to Telegram or DNS over HTTPS can signal this activity. Security teams are advised to monitor for dropped DLLs, changes to ProgramData, and suspicious scheduled tasks.