New Infostealer Uses AI to Rank Victims by How Much They Are Worth

Cisco Talos has analysed a new Windows infostealer that calls itself VOLTA-AUTODOXER, which surfaced through the CAIRN research effort. It steals the usual data, including browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, gaming and messaging sessions, Microsoft OAuth tokens, SSH and cloud keys, Wi-Fi profiles and screenshots. It then deletes itself. What sets it apart is a later stage that uses a large language model to sort through everything it has taken.

VOLTA builds a profile of the person behind the machine, including location, home address, employer, inferred birth year, card last-4 digits and Slack workspaces. It also uses stolen session access to dig further, such as searching Gmail for purchase receipts to confirm a home address and pulling food delivery order history. The bundle is sent to an AI service called OpenRouter, with instructions for the model to act as a forensic analyst. The output ranks the victim's assets by how easy they are to cash in, and assesses their security habits and password hygiene.

Talos also notes that the malware is built to cope with AI refusals. It checks each reply for phrases such as "I can't" and, if it finds one, passes the task along a chain of up to three models. In effect, the AI works as the attacker's triage analyst, turning a raw pile of stolen logins into a prioritised dossier.