Volta-Autodoxer Uses AI to Profile Victims — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Volta-Autodoxer steals browser passwords, Microsoft OAuth tokens, cookies, payment cards, crypto-wallet seed phrases and active Discord, Telegram, Steam and Roblox sessions, then compiles them into a serialized dossier.
- Volta-Autodoxer performs a second sweep of Gmail or another central account, using receipts and order histories from services including Uber Eats and DoorDash to build a fuller profile of the victim’s location and habits.
- Cisco Talos flagged the malware through CAIRN, a framework designed to identify hacking tools with AI capabilities, but researchers did not track whether Volta-Autodoxer had been used in the wild.
- Volta-Autodoxer sends its dossier through OpenRouter, defaulting to Anthropic’s Claude Opus 4.6 and falling back to Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash when guardrails block a request.
- Volta-Autodoxer embeds a 240-word prompt that casts the chatbot as a forensic intelligence analyst, asks for a citation-backed executive summary and target valuation, and says to “connect dots across fields” and “go deep, not wide.”
- Ryan Fetterman said the AI analysis is optional: Volta-Autodoxer still works without it, while cascading fallbacks are designed to move requests to more permissible models after refusals.
- CrowdStrike has observed four distinct hacking groups use AI to compromise dozens of targets worldwide, including government entities and businesses in health care, retail and travel.
Why it matters: Volta-Autodoxer operators gain automated victim triage, while CrowdStrike reports that four distinct hacking groups already use AI against dozens of targets worldwide. The material change is speed: Fetterman says faster identification of high-value targets improves the odds of using expiring authentication tokens and stolen passwords before they become invalid.
Ask SkimNews
