AI-Enhanced Infostealer Uses LLMs to Profile Victims
Cisco Talos researchers identified Volta-Autodoxer, an infostealer that collects credentials, authentication tokens, cookies, payment data, crypto wallet seed phrases, and active sessions. It compiles stolen information into a dossier and sends it through OpenRouter to language models for structured, citation-backed victim assessments, defaulting to Claude Opus 4.6 with fallbacks to Kimi K2 and Gemini 2.5 Flash. The researchers found the malware with CAIRN, a framework for detecting hacking tools that incorporate AI capabilities.
The research shows that commercial LLMs can be used to automate victim profiling and prioritization, while Volta remains functional even when its AI calls fail.
Saturday, October 31, 2026 08:00
- VOLTA is a mature stealer implant with an optional AI-integration layer. After stealing credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to an LLM to rank the victim’s assets by monetization value.
- If a model refuses to perform the target assessment, VOLTA fails over to a three-model chain, implying a direct engineering effort and expectation of hitting model guardrails.
- This stealer is self-deleting, and there is no attacker-owned infrastructure. The novelty in the AI-integration is that it is not supporting a traditional malware capability but working as an intelligence analyst on behalf of the operator.
There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics. A new malware self-named “VOLTA-AUTODOXER,” surfaced through the CAIRN research effort, is a self-deleting Windows infostealer that augments its post-theft workflow with an LLM-powered victim-profiling stage.
#Volta-Autodoxer#Cisco Talos#CAIRN#OpenRouter#Claude Opus 4.6#Kimi K2#Gemini 2.5 Flash