Cisco Talos Finds New Malware 'Volta-Autodoxer' Uses LLMs to Automatically Profile Victims
New malware integrates AI to organize stolen data and generate victim profiles to prioritize high-value targets.
Researchers at cybersecurity firm Cisco Talos have discovered a new strain of infostealer malware named “Volta-Autodoxer.” According to WIRED, the malware builds on traditional credential-stealing capabilities by integrating large language models (LLMs) to analyze stolen data, automatically constructing victim profiles to identify high-value targets.
Volta-Autodoxer first collects browser passwords, OAuth tokens, cookies, payment card details, and active sessions from apps like Discord and Telegram from infected devices. It then performs a second, deeper sweep using these initial findings, accessing core accounts like Gmail to retrieve receipts and order history from services such as UberEats and DoorDash, thereby refining the victim’s location and habits.
Once collected, the malware packages the data and sends it to AI models via OpenRouter for analysis. It defaults to Anthropic’s Claude Opus 4.6, falling back to Moonshot AI’s Kimi K2 or Google’s Gemini 2.5 Flash if refused. The embedded prompt instructs the AI to act as a “forensic intelligence analyst,” generating a structured report covering the victim’s identity, worth, and operational security (Opsec).
Ryan Fetterman, a researcher at Cisco Talos, noted that this automated triage allows attackers to lock onto high-value targets faster, enabling more effective use of stolen credentials before authentication tokens expire. Although Talos has not yet tracked the malware being used in the wild, the trend indicates that commercial LLMs are increasingly being used to enhance the capabilities of established malware types.