New Volta-Autodoxer Malware Uses Artificial Intelligence to Profile Victims

Researchers have discovered a new strain of infostealer malware named "Volta-Autodoxer" that integrates artificial intelligence tools to automatically collect, analyze, and rank data about victims [1]. The finding, uncovered by Cisco Talos researchers, highlights how established cyber threats are incorporating commercial large language models to streamline attacks [1].

AI-Powered Doxxing and Triage

Referred to internally as "Volta-Autodoxer," the malware operates as a mature infostealer designed to cast a wide net across infected machines [1]. According to Cisco Talos security researcher Ryan Fetterman, the system compiles stolen data into a serialized dossier and submits it to commercial LLM models, instructing the AI to act as an intelligence analyst to produce structured, citation-backed assessments of the victims [1].

Traditional infostealers have been responsible for numerous high-profile data breaches in recent years by harvesting credentials, cookies, and authentication tokens, leading to the theft of hundreds of millions of credentials [1]. Volta expands on these capabilities by targeting younger internet users through aggressive sweeps for browser-stored passwords, Microsoft OAuth tokens, payment cards, crypto wallet seed phrases, and active gaming and communication sessions such as Discord, Telegram, Steam, and Roblox [1].

Automated Analysis and Model Fallbacks

After gathering initial information, the malware performs a second, deeper sweep using central accounts like Gmail to collect location data, habits, and receipts from services such as UberEats and DoorDash [1]. The findings are then processed using OpenRouter, a platform capable of routing prompts to multiple AI providers [1].

Volta defaults its requests to Anthropic’s Claude Opus 4.6 [1]. To bypass potential safety guardrails, the malware includes fallback options, routing requests to Moonshot AI’s Kimi K2 and subsequently to Google’s Gemini 2.5 Flash if needed [1]. The creators embedded a 240-word prompt instructing the LLM to act as a forensic intelligence analyst, generating an executive summary, an evaluation of what the target is worth, and a review of their operational security [1].

Broader Threat Landscape

While Cisco Talos flagged the malware using its new CAIRN framework designed to detect AI-enabled hacking tools, researchers have not tracked whether Volta has been actively deployed in the wild [1]. Fetterman noted that clues within the malware suggest it may have been constructed to be sold to various attackers rather than restricted to a single campaign [1]. Other threat intelligence firms, such as Crowdstrike, have also observed distinct hacking groups globally utilizing AI for coding or data analysis [1].

Infostealers are a pervasive class of malware designed to extract usernames, passwords, cookies, and authentication tokens from compromised computers, fueling numerous major data breaches [1]. Security frameworks like Cisco Talos's CAIRN are specifically built to identify hacking tools that incorporate artificial intelligence features [1].

The integration of commercial artificial intelligence into malware allows cybercriminals to rapidly triage and identify high-value targets, bypassing the manual effort traditionally required to sift through stolen data before credentials expire.

The accessibility of automated targeting tools could lower the barrier of entry for lower-level attackers, enabling more invasive campaigns and faster exploitation of stolen digital credentials.

It remains unconfirmed whether Volta-Autodoxer has been actively deployed in real-world attacks, and security firms have primarily identified it through detection frameworks.