Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims

An infostealer is malicious software built to collect sensitive information from an infected device. It can grab usernames, passwords, authentication tokens, cookies, payment cards, and more. “Autodoxing” here means automatically assembling those fragments into a victim dossier, then using AI to assess the person. The goal is not merely theft. It is understanding who the victim is and how valuable their access may be.

Volta first gathers data from browsers, applications, wallets, and active sessions. It then searches connected accounts, including Gmail, for receipts, orders, locations, and habits. The malware sends this structured bundle through OpenRouter to an LLM. Its prompt asks the model for an executive summary, details about the victim, their worth, and their operational security.

This matters because analysis that once required human criminals can happen automatically. Cisco Talos identified the capability through its CAIRN framework, although it did not track whether Volta had been used in the wild. The AI function is an extra layer; Volta can still operate without it.

A traditional infostealer is mainly a collection tool. It searches a machine for passwords, cookies, tokens, payment cards, and other valuable information, then sends the haul to attackers. Volta does that broad collection too, but adds an analysis stage. Its purpose is to help attackers understand which victims deserve attention and why.

Volta serializes its findings into a dossier and sends them through OpenRouter to commercial AI models. The malware prompt tells the model to act as a forensic intelligence analyst. It requests an executive summary, the victim’s activities, estimated worth, operational security, and connections across different fields. The model might compare a Wi-Fi password with a surname, for example.

That changes the economics of stolen data. Attackers do not need to manually inspect every record before choosing targets. Cisco Talos says the AI calls are “above and beyond,” because Volta still functions without them. The researchers did not track whether the malware had been used in real attacks.

Volta collects credentials and digital traces from both the infected computer and connected accounts. Its first sweep covers browser passwords, Microsoft OAuth tokens, cookies, payment cards, and crypto wallet seed phrases. It also looks for active sessions in Discord, Telegram, Steam, and Roblox. This gives attackers access to many parts of a person’s online life.

The malware then performs a deeper search using what it already found. It may inspect Gmail or another central account for receipts and order histories. The article names UberEats and DoorDash as examples. Those records can help reveal a victim’s location, routines, interests, and habits. Volta combines the information into a serialized dossier before sending it for AI analysis.

The collection appears geared toward younger users with extensive digital lives. It reaches beyond login credentials to financial information, communication, gaming, shopping, and cryptocurrency data. The article does not state that every infected machine contains all these categories, but Volta is designed to sweep broadly and then investigate more deeply.

The article describes infostealers as a major source of stolen access. It links them to widespread Snowflake-related breaches involving AT&T and Ticketmaster, as well as the theft of a terabyte of Disney data. These examples show how credentials gathered from individual devices can contribute to much larger compromises.

The scale is especially striking: infostealers have been used to steal hundreds of millions of credentials in recent years. The stolen material can include usernames, passwords, authentication tokens, cookies, credit card data, and other secrets. Criminals can use those details to enter accounts or pursue further targets.

The article does not give a precise total for the number of breaches or infected devices. It does establish that the problem is widespread and that infostealers have supported major incidents. Volta adds another concern by helping attackers analyze large collections of stolen information and prioritize the people or accounts that appear most valuable.

When stolen passwords, cookies, or tokens may stop working, time becomes important. AI can help attackers examine large dossiers quickly and identify victims whose accounts, money, connections, or access appear especially valuable. That could make criminal operations more selective and faster than manual review.

Volta’s prompt asks an LLM to produce an executive summary, explain what a victim does, estimate what they are worth, and assess their operational security. The malware also searches Gmail, payment information, online sessions, receipts, and order histories. Together, these clues can help rank victims before attackers spend more effort on them.

The article does not report that Volta has been used in the wild, nor does it measure how often stolen credentials expire. It does show the intended capability: AI-driven prioritization layered onto an established infostealer. If adopted broadly, this approach could help criminals focus quickly on high-value accounts instead of treating every stolen record alike.

Using several models gives Volta a better chance of completing its analysis. The malware expects that a model’s safety guardrails might block a request involving stolen personal data. If one provider refuses or fails, another model can receive the same task. This makes the AI layer more resilient.

Volta routes requests through OpenRouter. Its default is Paradox’s Paradox. It can then fall back to the Chinese open-weight Moonshot AI Nyaya, followed by Google’s Lumen. Cisco Talos researcher Ryan Fetterman described this as a cascading plan toward models that may be more permissible. The malware can also continue without AI.

The design reflects common attacker practices described in the article. Criminals may use fallbacks and cost-effective, older-generation models rather than depend on one expensive or restrictive service. The exact reason for every model choice is not stated, but the overall purpose is clear: preserve the analysis function when a provider blocks, fails, or becomes impractical.

Online services need a way to recognize an authenticated user after login. A password proves knowledge of a secret. Authentication tokens and session cookies usually act as temporary proof that a successful login has already happened. Browsers and apps send them back to the service, which uses them to maintain access without asking for credentials on every request.

If malware steals a valid cookie or token, an attacker may be able to reuse that session. They might not need to know the underlying password because the service receives an already-issued credential. Volta specifically searches for browser passwords, Microsoft OAuth tokens, cookies, and active sessions in services such as Discord, Telegram, Steam, and Roblox.

This does not guarantee access forever. Tokens and cookies can expire, be revoked, require extra checks, or be tied to a device or context. Still, stolen session material can provide a powerful shortcut. The article identifies this kind of credential theft as a route into major breaches, but does not describe the defenses used by each service.