Cisco Talos Uncovers Volta-Autodoxer Malware That Uses 240-Word AI Prompt to Profile Victims
Updated
Updated · WIRED · Oct 31
Cisco Talos Uncovers Volta-Autodoxer Malware That Uses 240-Word AI Prompt to Profile Victims
1 articles · Updated · WIRED · Oct 31
Summary
Volta-Autodoxer packages stolen data into a serialized dossier and sends it to LLMs to rank victims, estimate “what they’re worth,” and assess their operational security, Cisco Talos researchers found.
The infostealer first grabs passwords, OAuth tokens, cookies, payment cards, crypto seed phrases, and live Discord, Telegram, Steam, and Roblox sessions, then digs through accounts like Gmail for receipts, location clues, and habits.
OpenRouter routes Volta’s AI requests by default to Anthropic’s Claude Opus 4.6, with fallbacks to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash if guardrails block the analysis.
Talos said it has not confirmed Volta in active attacks, but the malware still works without AI and appears mature enough to be marketed to multiple attackers rather than one campaign.
Hundreds of millions of credentials have been stolen by infostealers in recent years, and Talos says AI triage could help lower-skill criminals exploit valuable accounts before tokens expire or passwords change.