Security researchers at Cisco Talos have identified a new strain of infostealer malware that uses AI language models to automatically analyze stolen data and profile victims, according to research shared exclusively with Wired.
The malware, which Talos calls “Volta-Autodoxer” based on internal references, steals credentials and other sensitive information from infected machines, then sends a compiled dossier to commercial LLMs. According to Cisco Talos researcher Ryan Fetterman, the malware prompts the models “to act like an intelligence analyst and produce structured citation-backed assessment of the victim.”
Volta collects standard infostealer targets including browser passwords, Microsoft OAuth tokens, cookies, payment card data, and cryptocurrency wallet seed phrases. It also targets active sessions from Discord, Telegram, Steam, and Roblox, suggesting focus on younger users. After an initial sweep, the malware performs a deeper analysis by examining central accounts like Gmail to build a fuller profile of the victim and their location.
Fetterman described Volta as “pretty mature as a stealer” that “casts a pretty wide net for what it collects.” The AI component serves as “a prioritization and analysis function” to help attackers quickly identify high-value targets.
Talos identified the malware using CAIRN, a new framework the company built to detect hacking tools incorporating AI capabilities. Fetterman said Talos did not track whether Volta has been actively used in attacks.
Infostealer malware, often distributed through counterfeit software, has been linked to major data breaches in recent years. Wired notes that breaches affecting AT&T, Ticketmaster, and Disney resulted from hackers accessing systems using credentials gathered by infostealers, which have stolen hundreds of millions of login credentials overall.