Cisco Talos Finds Infostealer 'Volta-Autodoxer' Using LLMs to Profile Victims

Hackers have built AI analysis directly into a new strain of infostealer malware, enabling it to automatically profile victims and surface the highest-value targets among them, according to research from Cisco Talos shared exclusively with the Kernel Panic newsletter by Lily Hay Newman and Matt Burgess.

Talos researchers named the malware "Volta-Autodoxer" based on how the malware refers to itself internally. The finding shows how commercial large language models are being used to augment and enhance the capabilities of established types of malware — not to invent new attack techniques, but to accelerate and industrialize old ones.

What does the malware actually do?

Infostealers are designed to live up to their name. Often hidden in counterfeit software, they grab usernames, passwords, authentication tokens, cookies, credit card data, and more from infected machines. The stakes are considerable: many of the biggest data breaches in recent years — from the widespread Snowflake-linked breaches that included AT&T and Ticketmaster to the theft of a terabyte of Disney data — resulted from hackers accessing targets using login details gathered by infostealers. Overall, the malware class has been used to steal hundreds of millions of credentials in recent years.

Ryan Fetterman, a security researcher at Cisco Talos, said Volta's core collection functions are well developed.

"Volta is pretty mature as a stealer. It casts a pretty wide net for what it collects," Fetterman said. "It compiles all of those things together, ultimately producing a serialized dossier that it can send to a couple LLM models. It's asking the model to act like an intelligence analyst and produce structured citation-backed assessment of the victim. It's like a prioritization and analysis function."

Talos flagged the malware using its new CAIRN framework, built to identify hacking tools that incorporate AI capabilities. Fetterman noted that Talos did not track whether Volta has been used in the wild.

Whom does it target, and how deep does it dig?

Volta's traditional infostealer capabilities appear geared toward younger internet users with robust digital lives. A first sweep collects:

• Passwords stored in browsers
• Microsoft OAuth tokens
• Cookies
• Payment card data
• Crypto wallet seed phrases
• Active Discord, Telegram, Steam, and Roblox sessions

Then the malware runs a second, deeper sweep using its first-round findings. By looking through the target's Gmail or another central account, Volta builds a fuller picture of the victim, their location, and their habits using data like receipts and order history from services including UberEats and DoorDash.

The collection is where conventional infostealers stop. Volta continues.

How does the AI layer work?

Once collection is complete, the malware feeds its findings into AI tools for analysis using OpenRouter, a service that can send prompts to multiple different AI providers. Volta defaults its requests to Anthropic's Claude Opus 4.6. But apparently preparing for the possibility that the model's guardrails could block the activity, Volta is built with fallbacks to the Chinese open weight Moonshot AI Kimi K2 and, if that fails, Google's Gemini 2.5 Flash. Building in fallbacks and relying on cost-effective, older-generation models are common techniques among attackers, according to the reporting.

The malware's creators included a 240-word prompt, complete with bullet points and a numbered list, as part of their instructions to any LLM analyzing the collected data.

"You are a forensic intelligence analyst drafting a target assessment from a structured evidence bundle," the Volta prompt reads. It instructs the chatbot to produce an "executive summary" about the person, details of what they do, "what they're worth," and a summary of "their opsec." The prompt adds that the chatbot should "connect dots across fields" — for example, checking whether someone's Wi-Fi password matches their last name. It closes with a directive: "Go deep, not wide."

Fetterman said the prompt's wording is deliberate.

"The prompt is pretty carefully crafted not to imply anything overtly malicious," Fetterman said. "But they're building in the expectation to potentially hit model refusals at first request. And so they plan for failover kind of cascading to more permissible models as they go down the chain. And there's also the capability to still use the implant without the AI. The AI calls are kind of above and beyond, but the malware will still work without it."

Is this part of a broader trend?

Yes. Some low-level cybercriminals and scammers have complained about AI slop filling up cybercrime forums, but security researchers are increasingly discovering other hackers using LLMs for coding tasks or analyzing troves of stolen information. Researchers at threat intelligence firm CrowdStrike recently told WIRED they had seen four distinct hacking groups with varying sophistication — operating in Chinese, Spanish and English, Indonesian, and Russian — using AI tools to compromise dozens of targets around the world, including government entities and businesses in health care, retail, and travel.

For AI providers and policymakers, Volta is a concrete case study in a problem that has so far been discussed mostly in hypothetical terms: commercial models with safety guardrails being routed around through multi-provider plumbing, with less-restrictive alternatives waiting down the chain. OpenRouter-style aggregation makes that chain trivial to assemble.

What does the AI analysis buy the attacker?

Speed, and speed matters against expiring credentials. Fetterman explained the operational logic by referencing the fact that authentication tokens expire and passwords can be changed: the faster attackers triage their haul, the more of it remains usable.

"If you're able to identify your high-value targets faster, you probably have a better chance of using their credentials or authenticating using stolen tokens more often than maybe you would have if you had to do that triage yourself," Fetterman said.

Fetterman said Volta contains some clues that it may have been built to sell to a range of attackers rather than being developed for one specific actor's campaigns — a commercial product pattern that would spread the capability across the criminal market rather than confine it to one crew.

And while the malware at its core is still a traditional infostealer, the AI expansion foreshadows even more invasive activity in the future. The capability gap between low-sophistication attackers and well-resourced operations is narrowing, with LLMs doing the analytical work that previously demanded human time.

"We're seeing more advanced capabilities accessible to lower-level sophistication attackers," Fetterman said. "It's really interesting and disturbing."