conv.

All stories
SecurityQuiet 10d · day 12

VOLTA malware uses Claude AI to rank victims by financial value

Windows infostealer exfiltrates personal data to Anthropic's API, prioritizes targets by monetization potential, then self-deletes.

newest coverage 10d agosummary written 9d ago5 pieces1 likes & upvotes NewswiresGoogle NewsRedditHacker News

What to know

  • VOLTA-AUTODOXER steals personal data from Windows systems and pipes it to Claude Opus 4.6 via API to rank victims by financial value.
  • The malware can switch AI models if Claude refuses the request, or skip the AI ranking step entirely while still harvesting data.
  • Researchers found victims' email receipts and food-delivery order histories used to generate 'target assessments' for prioritization.

“A self-deleting Windows infostealer that calls itself VOLTA-AUTODOXER steals everything it can from a victim's PC”

Tom's Hardware · Tom's Hardware ↗ · Nov 1, 4:00 PM

Cisco Talos Security researchersAnthropic AI provider

VOLTA malware uses Claude AI to rank victims by financial value
tomshardware.com

How it unfolded 5 developments, newest first · click a bar or a number to jump articlesposts

Peak 2 pieces in 3h at Nov 1, 3 PM; 5 pieces over 12 days (2 articles · 3 posts) Oct 31, 7 AM — 1 piece · 1 article — Google News 1Oct 31, 10 AM — quietOct 31, 1 PM — quietOct 31, 4 PM — quietOct 31, 7 PM — quietOct 31, 10 PM — quietNov 1, 1 AM — quietNov 1, 3 AM — quietNov 1, 6 AM — quietNov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — 2 pieces · 1 article · 1 post — Newswires 1, Reddit 1Nov 1, 6 PM — 2 pieces · 2 posts — Reddit 1, Hacker News 1Nov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quietToday, 3 PM — quietToday, 6 PM — quiet 12–5
Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 9:50 PM ET
  1. 5

    Hacker News discussion of VOLTA Claude-powered malware

    Story reaches Hacker News audience, marking broader visibility in security and developer communities.

  2. 4

    Story continues circulating on Reddit

    Additional Reddit discussion of the VOLTA malware discovery.

  3. 3

    Security story circulates on Reddit

    Coverage of the malware discovery spreads across Reddit security communities.

  4. 2

    Tom's Hardware reports malware can bypass Claude refusal or skip AI step

    Coverage reveals the VOLTA payload can switch to alternative AI models if Claude declines the request, or skip the AI analysis stage entirely while still conducting data theft and ranking.

    “Stolen Gmail receipts and food-delivery orders feed an AI request for a 'target assessment' of each victim.”
    — Tom's Hardware · source
    1. 1 outlet New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely

      first by Tom's Hardware, 10d ago

  5. 1

    Cisco Talos discovers VOLTA-AUTODOXER infostealer using Claude API

    Researchers identified a Windows infostealer named VOLTA-AUTODOXER that exfiltrates victim data and feeds it to Claude Opus 4.6 to generate ranked assessments of victims' financial assets by monetization value. The malware self-deletes after execution.