Table of Contents
New research shared exclusively with WIRED reveals that hackers have integrated artificial intelligence into a new infostealer malware strain. Named “Volta-Autodoxer” by its creators, the software automatically profiles victims to quickly identify high-value targets and gather their information, as discovered by Cisco Talos researchers.
How the Volta Malware Operates
Infostealers typically hide inside counterfeit software to harvest usernames, passwords, authentication tokens, cookies, and credit card data from infected devices. These tools have driven major data breaches in recent years, including incidents involving Snowflake, AT&T, Ticketmaster, and Disney, stealing hundreds of millions of credentials overall.
According to Cisco Talos security researcher Ryan Fetterman, Volta is a mature stealer that casts a wide net before compiling the collected data into a serialized dossier. The malware then sends this dossier to large language models, asking them to act as intelligence analysts and produce structured, citation-backed assessments of the victim for prioritization and analysis.
Talos detected the malware using its new CAIRN framework, designed to identify hacking tools that incorporate artificial intelligence capabilities. However, Fetterman notes that Talos has not tracked whether Volta has been used in the wild.
Targeting and AI Analysis
Volta is geared toward younger internet users with active digital lives, sweeping for browser-stored passwords, Microsoft OAuth tokens, cookies, payment cards, crypto wallet seed phrases, and active sessions on Discord, Telegram, Steam, and Roblox. A second, deeper sweep through central accounts like Gmail builds a fuller picture of the victim, their location, and habits using receipts and order history from services such as UberEats and DoorDash.
The malware then feeds these findings into AI tools via OpenRouter, a service that routes prompts to multiple AI providers. Volta defaults to Anthropic’s Claude Opus 4.6, but includes fallbacks to Moonshot AI Kimi K2 and Google’s Gemini 2.5 Flash to bypass potential model guardrails.
The creators included a 240-word prompt instructing any analyzing LLM to act as a forensic intelligence analyst. The instructions require an executive summary, details on what the target does, an assessment of what they are worth, and a summary of their operational security, urging the chatbot to connect dots across fields.
Fetterman explains that the prompt is carefully crafted to avoid sounding overtly malicious while anticipating potential model refusals by planning for cascading failovers. The malware remains functional even if the AI calls fail entirely.
Broader Trends in AI and Cybercrime
While some low-level criminals complain about AI slop on cybercrime forums, security researchers increasingly find hackers using LLMs for coding tasks and analyzing stolen data. Crowdstrike intelligence researchers recently reported seeing four distinct hacking groups operating in multiple languages using AI tools to compromise dozens of targets globally, including government entities and businesses in health care, retail, and travel.
Fetterman states that Volta contains clues suggesting it was built to sell to various attackers rather than for a single actor’s campaign. While the core software remains a traditional infostealer, this AI expansion points toward more invasive future activity.
Identifying high-value targets faster increases the chances of successfully exploiting stolen credentials and authentication tokens before passwords change or tokens expire, according to Fetterman. This trend places advanced capabilities into the hands of lower-sophistication attackers, which he describes as both interesting and disturbing.
