New Windows Malware Steals Your Logins, Then Has an AI Write a Report Titled "WHAT THEY'RE WORTH"

Talos opens with the idea in one line: “cast a wide net, steal everything, and let AI sort out the specifics.”

The stealing part is the familiar list. VOLTA grabs “browser passwords; cookies; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots.”

“Every saved Wi-Fi password on the machine is pulled,” Talos writes. An embedded cracker goes after wallet vaults and writes the result to a line in its own report: WALLET VAULTS CRACKED.

Then it goes digging. With stolen Gmail access it searches the inbox for receipts from “Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal” to pin down a home address. It pulls Uber Eats and DoorDash order history. Roblox items get priced through a live lookup on Rolimons.

“That’s right: Your Uber Eats history is now a potential liability,” Talos writes.

All of that goes into one bundle: “geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation.”

The AI step

VOLTA posts that bundle to OpenRouter, a service that routes requests to many AI models. The system prompt tells the model to act as “a forensic intelligence analyst drafting a target assessment.” Its instructions include “Go deep, not wide… Be blunt, specific, accurate.”

The report it asks for has two sections with blunt names. “WHAT THEY’RE WORTH” ranks the victim’s valuables by how much money they’d make, tiered low, medium and high. “THEIR OPSEC” grades the victim’s security habits and password hygiene.

“The model is the operator’s triage analyst,” Talos writes.

The default model in the config is Anthropic’s Claude Opus 4.6, listed as anthropic/claude-opus-4.6. VOLTA checks each answer for refusals, phrases like “I can’t” or “I’m not able.” When it gets one, it falls back to Moonshot’s Kimi K2 and then Google’s Gemini 2.5 Flash, at a temperature of 0.2.

Who runs it

Nobody owns a server here. “The inference round-trip happens entirely through the victim’s own network connection,” Talos says, before the result leaves the machine. “There is no actor-owned infrastructure.”

Talos reads the code as a kit for sale. “The author sells access, the customer provides their values, and the builder compiles a custom binary for each order.” The buyer can then “start receiving ranked target assessments in their Telegram inbox.”

The sample in the report carries a build timestamp of August 17, 2026, and a first-seen date of October 11, 2026. Talos doesn’t say how many machines it has reached or name any victims.

Talos ends on what defenders should be watching: “The question for defenders is not whether this pattern will appear elsewhere, but which phase it touches next.” Its last line is about the net itself: “there is a difference between a wide net and a wide net that sorts itself.”