Hackers Could Use AI Malware to Dig Through Your Uber Eats History and Find Out Where You Live

A newly analysed Windows malware strain could search a victim's Uber Eats order history and Gmail receipts to work out where they live. The stolen information can then be fed into an AI model to build a detailed profile and identify accounts or assets worth targeting.

Security researchers at Cisco Talos disclosed the malware, known as VOLTA-AUTODOXER, on 31 October 2026. It targets personal information stored on compromised Windows computers and uses stolen account sessions to gather additional details about victims.

The findings expose a potential privacy threat. However, researchers have not confirmed whether the malware has been used in real-world attacks or successfully identified anyone's home address.

How Uber Eats Orders Could Reveal Your Home Address

According to Cisco Talos' technical analysis, VOLTA is an infostealer designed to collect sensitive information from infected Windows computers.

The malware can extract saved browser passwords, authentication cookies, payment card details and cryptocurrency wallet information. It also targets active sessions from services including Discord, Telegram, Steam and Roblox.

What makes VOLTA particularly concerning is what happens after the initial theft. Rather than stopping at stolen passwords, it can reuse authenticated sessions to retrieve more personal information.

Talos found that the malware can request order histories directly from Uber Eats and DoorDash accounts. It also searches Gmail for receipts linked to Amazon, Grubhub, Walmart, PayPal and other services. These records could reveal delivery addresses and provide clues about where a person lives.

Why Your Delivery History Matters

A food delivery receipt might reveal more than what someone ordered. It could contain an address, transaction details and information about when a purchase was made.

One delivery address does not necessarily identify someone's home. The order might have been sent to an office, hotel or another person's property.

However, an address appearing repeatedly across food deliveries and shopping receipts could provide a stronger indication of where someone lives.

VOLTA is designed to combine those records with other stolen information, including location data and details collected from the infected computer.

Talos describes the malware using purchase receipts to corroborate a home address. However, its research does not establish how accurately the software can make that determination.

The reported method also relies on compromised devices and stolen account access. Neither Talos nor WIRED reported a breach of Uber Eats or DoorDash systems.

AI Helps Hackers Identify Valuable Targets

VOLTA's most unusual feature comes after it gathers the stolen information.

The malware assembles the records into an identity report before sending the data through OpenRouter, a service that connects applications to different AI models.

The sample analysed by Talos was configured to use Anthropic's Claude Opus 4.6 first. If a request failed or was refused, it could switch to Moonshot AI's Kimi K2 and then Google's Gemini 2.5 Flash.

The inclusion of these models does not establish that each processed stolen victim data. The research describes the malware's configuration and capabilities, not confirmed responses from all three services.

The AI prompt instructs the selected model to act as an intelligence analyst. It asks for an assessment of the victim, connections between stolen records and a ranking of potentially valuable assets.

This could help an attacker identify which stolen accounts or credentials deserve attention without manually examining every receipt and password.

'We're seeing more advanced capabilities accessible to lower-level sophistication attackers,' Cisco Talos researcher Ryan Fetterman told WIRED.

Fetterman explained that faster analysis could give attackers more opportunities to use stolen credentials or authentication tokens before they expire or victims change their passwords.

The malware can also operate without the AI component. Its data collection and theft capabilities do not depend on a successful AI request.

Has VOLTA Malware Already Targeted Victims?

Cisco Talos identified the analysed sample as first seen on 11 October 2026, before publishing its findings later that month.

However, Fetterman told WIRED that researchers had not tracked whether VOLTA had been used in real-world attacks.

The findings therefore establish what the analysed malware is capable of doing, rather than demonstrating a confirmed campaign against Uber Eats customers.

There is also no verified victim count or evidence showing that the malware has successfully identified someone's home address through delivery records.

How to Protect Your Accounts

Cisco Talos recommends revoking potentially compromised authentication tokens and changing exposed passwords after a suspected infection.

Users should also review active account sessions and sign out of unfamiliar devices where the service provides that option. Changing a password alone may not immediately invalidate every stolen session.

Anyone who suspects an infostealer infection should use trusted security software to investigate the affected computer. Sensitive passwords should be changed from a device known to be clean.

Talos also advises preserving VOLTA's debug log, if available, because it records the information collected and whether the malware's AI request succeeded. This may help investigators assess the extent of a compromise.

The research highlights a broader danger: stolen passwords are not the only information criminals can exploit. Everyday records, including food deliveries and shopping receipts, can become useful clues when combined with other personal data.

With AI helping to organise that information, criminals could potentially build more detailed victim profiles without spending hours reviewing the stolen records themselves.