Your Takeout Receipt Has Joined the Dossier

Cisco Talos researchers have identified malware called Volta-Autodoxer that collects login credentials, payment data, active account sessions, and records such as UberEats receipts, Wired reports. The malware compiles the findings into a dossier and submits the material to AI tools for analysis. Talos researcher Ryan Fetterman says the team did not track whether Volta has been used in the wild.

The documented AI role is assessment after collection. According to Fetterman, the malware asks models to act as an intelligence analyst and produce a structured, citation-backed assessment of the victim. Volta sends its findings through OpenRouter, a service that routes prompts to different AI providers. That workflow does not establish that a model independently chooses whom to infect.

The collection has two stages. Volta first sweeps for browser passwords, Microsoft OAuth tokens, cookies, payment cards, crypto wallet seed phrases, and active sessions for services including Discord and Steam. It then uses initial findings to look deeper into Gmail or another central account. Receipts and order histories from UberEats and DoorDash can contribute information about location and habits.

Credentials and receipts create different risks. A stolen token may provide account access. An order history supplies context about the person behind the account. Combining access with context could help an attacker decide which accounts deserve further attention. The dinner receipt has acquired an intelligence assignment.

The delivery service kept a record of a transaction. The attacker repurposes that record to assess a person. The security problem is not that a receipt secretly contains a complete biography. It is that a compromised central account can make many otherwise separate records available for aggregation.

AI can organize those records without making the resulting profile reliable. Citations may point to stolen source material; they do not independently validate the model’s conclusions. Nor does the name “Autodoxer” establish that anyone’s personal information was published. The supplied reporting documents collection and an analysis workflow, not a confirmed public dossier or a victim count.

Talos detected the malware using CAIRN, its framework for identifying hacking tools that incorporate AI capabilities. The supplied account does not provide a Volta-specific removal procedure or document an operator’s completed remediation. Those limits matter: identifying the tool is not the same as establishing where it ran or what it took.

For a confirmed infection, the response should address both the device and stolen access. Device administrators should remove the malware, and affected account holders should use a clean device to reset exposed credentials and revoke compromised sessions through the relevant providers. These are general containment recommendations, not a reported Volta cleanup. Talos can supply detection findings; account providers and device administrators must turn evidence of compromise into decisions about access.