Volta-Autodoxer

Volta-Autodoxer is a self-deleting, 64-bit Windows information stealer that combines broad data collection with large-language-model-assisted victim profiling. It collects browser passwords, cookies, payment-card information, Microsoft OAuth tokens, SSH keys, cryptocurrency wallet recovery phrases, Wi-Fi passwords, screenshots, and application configuration data. It also steals active sessions from messaging, gaming, and collaboration applications, including Discord, Telegram, Steam, and Roblox.

After its initial collection pass, Volta-Autodoxer uses stolen authentication material to gather additional information from compromised accounts. It searches email for purchase receipts, retrieves food-delivery order histories, and enriches account profiles to assemble a structured victim dossier. It submits this dossier through OpenRouter for AI-generated assessments of victims' assets, security practices, and potentially valuable information. Its analysis workflow includes fallback models when a preferred model refuses a request.

Volta-Autodoxer is offered through a customized-builder sales model in which customers supply API credentials and a Telegram channel. It packages collected information into ZIP archives for exfiltration and deletes its executable. Its workflow relies on third-party services rather than dedicated attacker-owned infrastructure. No specific threat actor or initial infection vector has been established, and its use in real-world attacks has not been confirmed.