AI-driven Windows malware uses Claude to rank stolen data by value, then deletes itself

Cisco Talos says the VOLTA infostealer sends stolen victim data to Claude Opus 4.6 to rank assets by monetization value, can switch models if one refuses, and deletes itself afterward.

Read the full story at Tom's Hardware ↗

Timeline · 2 reports

1. 2026-11-01 21:00 · Tom's Hardware
   New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely
2. 2026-11-01 21:00 · Tom's Hardware
   New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself