What changed

A new strain of infostealer malware, dubbed 'Volta-Autodoxer,' has been identified by Cisco Talos researchers. This malware integrates AI functionality to automatically profile victims and prioritize the most valuable targets based on stolen data. The malware uses AI tools like OpenRouter, defaulting to Anthropic's Claude Opus 4.6, with fallbacks to Moonshot AI Kimi K2 and Google's Gemini 2.5 Flash.

What this means in practice

Volta-Autodoxer is designed to collect a wide range of data from infected machines, including usernames, passwords, authentication tokens, payment card details, and cryptocurrency wallet seed phrases. It also scans for active sessions on platforms like Discord, Telegram, Steam, and Roblox.

Once this data is collected, the malware performs a deeper analysis using AI to build a comprehensive profile of the victim, including their location, habits, and potential value. The AI-generated assessments help attackers prioritize targets and improve their chances of successful exploitation.

Limitations and availability

The malware's AI capabilities are an enhancement to its traditional infostealer functions. While the AI analysis is optional, the malware can still function without it. Cisco Talos researchers noted that they did not track whether Volta-Autodoxer has been used in the wild.

The malware includes a 240-word prompt instructing the AI to act as a forensic intelligence analyst, producing an executive summary of the victim's activities and potential value.

The prompt is designed to avoid overtly malicious language but still includes instructions for handling model refusals and cascading to more permissible models.

Source facts for New malware uses AI to prioritize stolen data: Overall, the malware has been used to steal hundreds of millions of credentials in recent years.“Volta is pretty mature as a stealer. It casts a pretty wide net for what it collects,” says Ryan Fetterman, a security researcher at Cisco Talos. “It compiles all of those things together, ultimately producing a serialized dossier that it can send to a couple LLM models.
Original AINewsTrend explainer based on the cited source. This graphic summarizes source statements; it is not an independent benchmark.

Sources and further reading

  1. wired: Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims