Cybersecurity researchers have identified a new Windows infostealer called VOLTA-AUTODOXER (aka VOLTA) that uses large language models to rank stolen data by monetization value. The malware harvests passwords, cookies, Outlook and Slack data, payment cards, cryptocurrency seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud keys, Wi-Fi profiles and screenshots. It enriches the evidence bundle with Gmail receipt searches for Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal, then sends the bundle to an AI system via OpenRouter, defaulting to Anthropic's Claude Opus 4.6 and falling back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash. A 240-word system prompt forces the model to act as a forensic analyst, outputting a "WHAT THEY'RE WORTH" section with low/medium/high tiers and a "THEIR OPSEC" assessment. Exfiltration occurs over Telegram in three stages: initial credential dump, post-AI analysis results, and live enrichment with Gmail data. The tool appears to use a builder kit, allowing customers to receive AI-generated target dossiers in their Telegram inbox. 1