Hackers are now weaponizing AI, integrating it into a new strain of infostealer malware named "Volta-Autodoxer." This advanced cyber tool can automatically profile victims, efficiently pinpointing the most valuable targets and their sensitive information.
Researchers at Cisco Talos discovered that the malware, which refers to itself as "Volta" internally, leverages commercial large language models (LLMs) to boost its capabilities. Infostealers are notorious for pilfering data like usernames, passwords, authentication tokens, cookies, and credit card details from compromised machines, often hidden within fake software. These stolen credentials have been the gateway for major data breaches affecting huge companies.
Ryan Fetterman, a security researcher at Cisco Talos, explained that Volta is a sophisticated infostealer that gathers a wide range of data. It then compiles this information into a "serialized dossier" and sends it to LLMs. The AI is instructed to act as an intelligence analyst, producing structured assessments of the victim, effectively prioritizing targets and their data.
Talos identified this AI-enhanced malware using its new CAIRN framework. While Talos hasn't confirmed if Volta has been actively used "in the wild," its capabilities are designed to target younger internet users with extensive digital footprints. Volta first scans for stored passwords, OAuth tokens, cookies, payment card info, and cryptocurrency wallet details, along with active sessions on platforms like Discord, Telegram, Steam, and Roblox.
Following this initial sweep, Volta performs a deeper analysis by accessing central accounts like Gmail to build a comprehensive profile, including the victim's location and habits derived from receipts and order history from services like Uber Eats and DoorDash. This collected data is then fed into AI tools via OpenRouter, which can query multiple AI providers. Volta primarily defaults to Anthropic's Claude Opus, with fallbacks to Moonshot AI Kimi K2 and Google's Gemini 2.5 Flash, showcasing attackers' common practice of utilizing cost-effective models and building in redundancies.
The malware includes a detailed prompt for the AI, instructing it to act as a forensic intelligence analyst and generate an executive summary of the target, detailing their activities, financial worth, and operational security. The prompt emphasizes "connecting dots across fields" and going "deep, not wide" to uncover insights. While the AI integration is optional, Volta retains its core infostealing functionalities even without it.
This development aligns with a growing trend where cybercriminals are using LLMs not just for coding assistance but also for analyzing stolen data. Fetterman suggests that Volta's design might indicate it's intended for sale to various attackers. The AI's ability to quickly identify high-value targets is a disturbing advancement, potentially enabling less sophisticated attackers to achieve greater success with stolen credentials before they expire or change.
