Malware · AI Security · Privacy
AI-powered Volta malware profiles victims and steals personal data
Researchers have found a new malware called Volta-Autodoxer that uses AI to analyse stolen data and profile victims, targeting login credentials, payment cards, and online accounts.
Ross Grant3 min read
The short version
A new malware called Volta-Autodoxer has been found by security researchers. It steals personal data like passwords, credit card numbers, and online session details from infected computers. What makes it different is that it uses AI to quickly analyse the stolen data and build a profile of each victim. This could help attackers target people more efficiently.
What happened?
Researchers at Cisco Talos have identified a new malware strain called Volta-Autodoxer that uses AI to analyse and profile victims based on stolen data. The malware collects login credentials, payment information, and online session tokens, then sends this data to large language models for automated analysis. It targets platforms like Discord and services such as UberEats. According to Wired, it has not yet been confirmed whether Volta has been used in real-world attacks.
What was taken
The Volta-Autodoxer malware collects a wide range of personal data from infected computers. According to Cisco Talos researchers, it grabs usernames, passwords, authentication tokens (used to keep users logged in), cookies, credit card details, and crypto wallet seed phrases. It also targets active sessions for popular platforms like Discord, Telegram, Steam, and Roblox. The malware goes further by scanning the victim's email accounts for receipts and order histories from services such as UberEats and DoorDash, building a detailed picture of the victim's habits and location. [Wired (opens in a new tab)]
How the attack worked
Volta-Autodoxer is usually hidden in counterfeit software. Once installed, it performs an initial sweep for stored passwords, tokens, and payment information. It then uses the information found to conduct a deeper search, looking through central accounts like Gmail for more personal data. After collecting this information, Volta-Autodoxer sends it to several AI models using a service called OpenRouter. The malware's instructions tell the AI to act as a forensic analyst, producing a structured report on the victim, including an executive summary, what the person does, their potential value, and their operational security (opsec). The prompt even suggests cross-checking details, such as whether a Wi-Fi password matches the victim's last name. If the main AI model refuses the request, the malware automatically tries other models, including some with fewer restrictions.
How the flaw works
The key innovation in Volta-Autodoxer is its use of large language models (LLMs) to automate the analysis of stolen data. Instead of attackers manually sorting through files, the malware sends the data to an AI, which quickly profiles victims and highlights high-value targets. This makes it easier for attackers to exploit credentials before passwords are changed or tokens expire. The AI component is optional: the malware still works as a traditional infostealer if the AI is unavailable, but the analysis feature gives attackers an edge in speed and efficiency.
The response
Cisco Talos researchers discovered Volta-Autodoxer using their CAIRN framework, which is designed to spot hacking tools that use AI. They have not confirmed whether Volta has been used in real-world attacks yet. The malware appears to be designed for sale to multiple attackers, not just a single group. Other security researchers have also seen hacking groups using AI tools for coding and analysing stolen data, but Volta's approach is more advanced and automated.
What you should do
If you download software from unofficial sources, you risk installing malware like Volta-Autodoxer. Use only trusted, official sites for downloads. Keep your operating system and security software up to date. If you suspect your device is infected, change passwords and check for unusual account activity. Security teams should watch for signs of infostealer malware and consider how attackers might use AI to process stolen data faster than before.
Why it matters
Volta-Autodoxer shows how attackers are using AI to automate and improve cybercrime. By quickly analysing stolen data, attackers can act before victims have a chance to change passwords or secure their accounts. This raises the stakes for both individuals and security teams.
Key points
- Volta-Autodoxer is a new malware that uses AI to profile victims.
- It steals passwords, payment cards, and online session tokens.
- The malware targets platforms like Discord, Steam, and Roblox.
- AI analysis helps attackers find high-value targets faster.
- Downloading software from unofficial sources increases infection risk.
Sources
Wired
Reference
