AI-Powered Infostealer Malware Profiles Victims — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Volta-Autodoxer incorporates AI to profile victims by feeding stolen data to LLMs, requesting structured intelligence-style assessments on targets’ identities, habits, and security practices
- Cisco Talos detected the malware using its CAIRN framework designed to spot AI-enhanced hacking tools, though it has not confirmed Volta’s use in active attacks
- Anthropic’s Claude Opus 4.6 is the default AI model used by Volta, with fallbacks to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash in case of refusals or access issues
- OpenRouter serves as the AI gateway for Volta, allowing the malware to route prompts across multiple LLM providers for reliability and cost efficiency
- Ryan Fetterman notes the malware includes a 240-word prompt instructing the AI to act as a forensic analyst, connecting personal data points like Wi-Fi passwords and last names without overtly triggering model safeguards
- Volta targets digital-native users by harvesting credentials from browsers, social platforms like Discord and Telegram, gaming services including Steam and Roblox, and financial data such as crypto wallets and payment cards
- Crowdstrike researchers report observing four distinct hacking groups in different languages using AI tools to attack government and private sector targets across health care, retail, and travel
Why it matters: Lower-sophistication attackers now have access to AI-powered triage that speeds up exploitation of stolen credentials before they expire or are reset, increasing the risk for individuals and organizations as automated victim profiling becomes scalable. This lowers the barrier to high-impact cybercrime.
Ask SkimNews
