Cisco Talos Unveils 'Volta-Autodoxer': AI-Powered Infostealer That Auto-Profils High-Value Targets

In a significant escalation of cyber threats, Cisco Talos researchers have identified a novel strain of infostealer malware dubbed "Volta-Autodoxer" that integrates Large Language Models (LLMs) to automatically profile victims. This development marks a critical shift in the cybercrime landscape, where malicious actors are leveraging commercial AI to enhance the efficiency and precision of data theft. Unlike traditional stealers that merely harvest credentials, Volta-Autodoxer acts as an autonomous intelligence analyst, rapidly identifying high-value targets from the vast trove of stolen information. The malware, often distributed via counterfeit software, executes a two-stage data collection process. Initially, it sweeps infected machines for sensitive assets such as browser passwords, Microsoft OAuth tokens, cookies, credit card details, and cryptocurrency wallet seed phrases. It also captures active sessions from popular platforms including Discord, Telegram, Steam, and Roblox, indicating a specific targeting of younger, digitally active users. In a second, deeper sweep, the malware analyzes central accounts like Gmail to reconstruct the victim’s lifestyle, location, and habits using data from services such as UberEats and DoorDash. Once the data is compiled, the malware utilizes the OpenRouter service to feed this information into AI models for analysis. By default, it targets Anthropic’s Claude Opus 4.6, but includes fallback mechanisms to Chinese open-weight models like Moonshot AI Kimi K2 and Google’s Gemini 2.5 Flash to bypass potential safety guardrails. The system employs a meticulously crafted 240-word prompt instructing the AI to act as a forensic intelligence analyst, producing a structured, citation-backed assessment of the victim’s "worth" and operational security (opsec). This automated triage allows attackers to prioritize targets whose credentials are still valid, significantly reducing the time between data theft and exploitation. Ryan Fetterman, a security researcher at Cisco Talos, noted that while the AI component is an "above and beyond" feature, the malware remains functional without it. The presence of fallback models and cost-effective older-generation AI suggests the tool is designed for broad distribution among various threat actors rather than a single sophisticated group. This trend reflects a broader pattern where low-level cybercriminals are gaining access to advanced capabilities through AI, as evidenced by recent reports from CrowdStrike regarding multiple hacking groups using AI to compromise government and corporate entities. The implications of Volta-Autodoxer are profound for the future of digital security. By automating the analysis of stolen data, attackers can more effectively exploit authentication tokens before they expire or passwords are changed. This capability lowers the barrier to entry for complex attacks, making it easier for less sophisticated actors to conduct high-impact intrusions. As AI continues to be integrated into the cybercrime toolkit, security professionals must anticipate more invasive and automated threats that can rapidly identify and exploit high-value targets.