New 'Volta-Autodoxer' Infostealer Integrates Artificial Intelligence to Profile Victims

Emerging Threat Combines Traditional Data Theft with Automated AI Analysis

Security researchers have identified a new strain of infostealer malware that incorporates artificial intelligence to automatically profile victims and prioritize high-value targets. According to findings from Cisco Talos researchers, the malware is internally referred to as "Volta-Autodoxer."

Infostealers typically target browsers, saved passwords, authentication tokens, cookies, credit card data, and cryptocurrency wallet seed phrases. The Volta malware executes a broad initial sweep of compromised machines and then performs a secondary search through central accounts, such as Gmail, to gather additional details including location, habits, and order history from delivery services.

Automated Intelligence Analysis and Model Fallbacks

Once the data is collected, the malware compiles it into a structured dossier and sends it to commercial large language models (LLMs) via OpenRouter.

• Primary AI Target: The malware reportedly defaults to Anthropic’s Claude models for analysis.
• Built-in Fallbacks: To mitigate potential safety guardrail blocks, the system includes fallback logic incorporating other models, such as Moonshot AI Kimi and Google Gemini.
• Analysis Instructions: The malware utilizes a prompt instructing the LLM to act as a forensic intelligence analyst, generating an executive summary, evaluating the target's worth, and assessing operational security.

Practical Implications and Verification

Researchers noted that while the AI component automates the triage of stolen information, the core infostealer can still function independently if AI API calls fail. Security experts warn that such automation could allow lower-level cybercriminals to identify valuable credentials more quickly before authentication tokens expire or passwords are changed.

Cisco Talos flagged the tool using its CAIRN framework, which is designed to identify hacking tools featuring AI capabilities. However, researchers reported that they have not tracked whether the Volta malware has been actively deployed in the wild.

To verify original research announcements regarding emerging malware variants, security professionals typically monitor threat intelligence advisories published directly by cybersecurity firms such as Cisco Talos, or consult framework documentation associated with behavioral detection tools.