AI-powered 'Volta' malware auto-profiles victims
Original: Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims
Why This Matters
Shows LLMs now automate victim triage, raising infostealer threat at scale.
Cisco Talos researchers discovered 'Volta-Autodoxer,' an infostealer that uses Claude, Kimi K2, and Gemini as fallbacks to auto-generate structured dossiers on victims—targeting gamers, crypto users, and food delivery accounts.
Cisco Talos has identified a new infostealer strain called Volta-Autodoxer that layers AI analysis on top of conventional credential theft. The malware first sweeps infected machines for passwords, Microsoft OAuth tokens, browser cookies, payment cards, crypto wallet seed phrases, and active sessions on Discord, Telegram, Steam, and Roblox. It then pivots to a deeper pass through Gmail and similar accounts, pulling receipts from UberEats and DoorDash to map out victims' habits, location, and routines.
Once collection is complete, Volta ships its haul to OpenRouter—a multi-provider AI gateway—and prompts the model to act as an intelligence analyst, producing a structured, citation-backed victim profile. The default model is Anthropic's Claude Opus 4.6. If guardrails block the request, the malware falls back to Chinese open-weight model Moonshot AI Kimi K2, then to Google's Gemini 2.5 Flash.
"It's asking the model to act like an intelligence analyst and produce structured citation-backed assessment of the victim. It's like a prioritization and analysis function," said Cisco Talos researcher Ryan Fetterman. Talos flagged Volta using its new CAIRN framework, built to detect hacking tools that incorporate AI. The researchers have not confirmed active in-the-wild use.