New malware ‘Volta-autodoxer’ integrates AI for targeted data theft
Security researchers at Cisco Talos have uncovered a new strain of infostealer malware, dubbed “Volta-Autodoxer,” that incorporates artificial intelligence to identify and prioritize high-value targets. The malware, internally referred to as Volta, utilizes commercial large language models (LLMs) to analyze victim data and create detailed profiles.
Infostealers are notorious for stealing sensitive information such as usernames, passwords, credit card details, and authentication tokens from infected devices. These tools have been implicated in major data breaches, including incidents affecting AT&T, Ticketmaster, and Disney, resulting in the theft of hundreds of millions of credentials over recent years.
According to Ryan Fetterman, a security researcher at Cisco Talos, Volta goes beyond traditional infostealing by compiling collected data and sending it to LLMs. “It’s asking the model to act like an intelligence analyst and produce structured, citation-backed assessments of the victim. It’s like a prioritization and analysis function.”
The malware initially searches for common login information, then conducts a deeper sweep, examining accounts like Gmail to gather data on location, habits, and financial transactions from services like UberEats and DoorDash. This information is then processed using OpenRouter, which connects to various AI providers, defaulting to Anthropic’s Claude Opus 4.6, with backups including Moonshot AI Kimi K2 and Google’s Gemini 2.5 Flash.
Volta’s creators have included a detailed 240-word prompt instructing the AI to generate an “executive summary” of the victim, including their perceived value and operational security practices. The prompt emphasizes connecting seemingly unrelated details, such as checking if a Wi-Fi password matches a person’s name.
While the AI component is advanced, Fetterman notes that the malware remains functional without it. This development highlights a concerning trend of increasingly sophisticated tools becoming accessible to lower-level cybercriminals. Researchers at Crowdstrike have observed multiple hacking groups using AI for coding and data analysis, impacting organizations globally.
Cisco Talos identified the malware using its CAIRN framework, designed to detect AI-powered hacking tools. Fetterman suggests that Volta’s design indicates it may be intended for sale to a broad range of attackers, foreshadowing a future of even more invasive cyber threats.
Source
“Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims”
Read the original report ↗This story is an AI-assisted version of the original report, checked and edited by the Plainwire desk before publication. Read our editorial policy · Report an error
Read next
Human intervention remains key for advanced AI agents
Despite advancements in artificial intelligence, many AI agents still require human assistance to complete tasks like negotiating bills or…
Related
Caught up in five lines
The Brief: the day’s biggest stories, written by our desk at and .