Cisco Talos researchers identify malware that uses AI to profile victims
🎧 Listen to this story
Cisco Talos researchers identified Volta-Autodoxer, a new strain of infostealer malware that gathers credentials, tokens, cookies, payment cards, crypto-wallet data, and active sessions from services including Discord, Telegram, Steam, and Roblox. The malware also searches central accounts for deeper information, including UberEats and DoorDash receipts and order histories, to build a profile of the victim.
According to Wired, the code sends this material through OpenRouter to AI models that produce a structured assessment, including an executive summary, the target’s habits, estimated wealth, and operational security practices. Claude Opus 4.6 is the default model, with Kimi K2 and Gemini 2.5 Flash as fallbacks if the activity is blocked. Cisco Talos says it did not track whether Volta has been used in real-world attacks.
Why it matters · editorial interpretation
The case suggests a shift in how malware may use models: beyond stealing data, Volta-Autodoxer organizes it into assessments of the victim, according to Cisco Talos and Wired. That could increase the operational value of collected credentials and histories, although Cisco Talos did not confirm real-world attacks using the tool.
Sources
Security