Hackers are adding artificial intelligence capabilities to a new strain of information-stealing malware, enabling it to automatically profile victims, identify high-value targets and surface their most valuable data, according to research shared exclusively with Kernel Panic. Cisco Talos researchers say the malware, known internally as “Volta-Autodoxer,” uses commercial large language models (LLMs) to enhance the capabilities of an established type of cybercrime tool.
AI-assisted victim profiling
Information stealers are often hidden in counterfeit software and are designed to collect usernames, passwords, authentication tokens, cookies, credit card details and other sensitive information from infected computers. Recent incidents have included major Snowflake-related breaches involving AT&T and Ticketmaster, as well as the theft of terabytes of data. In one case involving Disney data, a hacker accessed the target using login details collected by an information stealer. Overall, this type of malware has been used to steal hundreds of millions of credentials in recent years.
“Volta is pretty mature as a stealer. It casts a pretty wide net in what it collects,” said Ryan Fetterman, a security researcher at Cisco Talos. “We compile all of this together and ultimately create a serialized document that can be sent to several LLM models. We ask the models to act like intelligence analysts and create structured victim assessments backed by citations. This is like a prioritization and analysis function.”
Talos identified the malware using its new CAIRN framework, which was built to detect hacking tools that incorporate AI capabilities. Fetterman emphasized that Talos does not track whether Volta is actually being used.
Data collected by Volta
Volta’s conventional information-stealing capabilities are extensive and appear to target younger internet users with substantial digital lives. The malware scans for passwords stored in browsers, Microsoft OAuth tokens, cookies, payment cards and cryptocurrency wallet seed phrases. It also targets active sessions for Discord, Telegram, Steam and Roblox.
After the initial collection, Volta uses the results to conduct a second, more detailed sweep. It examines Gmail and other central accounts, along with information such as receipts and order histories from services including UberEats and DoorDash. The aim is to build a detailed picture of a victim’s identity, location and habits.
Multiple AI models
Once the data has been gathered, the malware uses OpenRouter, a service that can route prompts to multiple AI providers, to submit the results for analysis. Volta’s default request is directed to Anthropic’s Claude Opus 4.6.
However, the malware also includes fallback options, apparently in case a model’s safety guardrails prevent it from processing the request. Those alternatives are China’s Moonshot AI Kim K2 and, if that fails, Google’s Gemini 2.5 Flash. Using fallback models and relying on less expensive legacy models are common techniques among attackers.
Source: www.wired.com
