AI-driven Windows malware VOLTA uses Claude to rank stolen data before self-deleting

This story is from 2026-11-01. It is preserved in the archive; the latest stories are on the live feed.

Cisco Talos says the VOLTA infostealer sends stolen victim data to Claude Opus 4.6 to rank assets by monetization value, then deletes itself. The payload can switch models if one refuses or skip the AI step entirely.

Read the full story at Tom's Hardware ↗

Timeline · 2 reports

1. 2026-11-01 21:00 · Tom's Hardware
   New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely
2. 2026-11-01 21:00 · Tom's Hardware
   New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself