November 3 ,2026
Data breaches could get worse
While major data breaches have previously been traced to login credentials stolen by infostealer malware, the integration of mainstream LLMs give such established threats a new edge.
Read More
Hackers are using AI to enhance infostealer malware, automating the profiling of potential victims to identify high-value targets and quickly extract information about them, according to new research.
The new AI-driven strain of infostealer malware known as ‘Volta-Autodoxer’, was uncovered by researchers at Cisco’s threat intelligence unit Talos using its new CAIRN framework built to identify hacking tools that incorporate AI capabilities. It is unclear if Volta-Autodoxer has already been in use.
Notably, the researchers’ findings highlight how commercial large language models (LLMs) developed by Anthropic, Google, and Moonshot AI, are being used to augment and enhance the capabilities of established types of malware. It is yet another instance of how even conventional infostealer malware can be turned into a serious threat with the integration of AI.
By automating tasks that would otherwise require considerable time and manual effort, it shows how AI tools in the hands of malicious actors are also being used to compress the timeline of an attack.
“Volta is pretty mature as a stealer. It casts a pretty wide net for what it collects. It compiles all of those things together, ultimately producing a serialized dossier that it can send to a couple LLM models. It’s asking the model to act like an intelligence analyst and produce structured citation-backed assessment of the victim. It’s like a prioritisation and analysis function,” Ryan Fetterman, a security researcher at Cisco Talos, was quoted as saying
“We’re seeing more advanced capabilities accessible to lower-level sophistication attackers. It’s really interesting and disturbing […] If you’re able to identify your high-value targets faster, you probably have a better chance of using their credentials or authenticating using stolen tokens more often than maybe you would have if you had to do that triage yourself,” he added.
How it works and how it damages
Generally found hidden in counterfeit software, infostealers are a type of malware used by hackers to vacuum up usernames, passwords, authentication tokens, cookies, credit card data, and more from compromised systems. Several major data breaches in the past have been executed using login credentials gathered by infostealers.
The Volta infostealer has been enhanced using AI to target younger internet users with robust digital lives, according to Talos researchers. First, it sweeps for passwords stored in browsers, Microsoft OAuth tokens, cookies, payment cards, and crypto wallet seed phrases. It has also been redesigned to target Discord, Telegram, Steam, and Roblox sessions.
By scanning and extracting information from a target’s Gmail or social media account, Volta enables hackers to gather a full profile of their potential victims such as their location and eating habits based on their order history from online food delivery apps. After all the data on the target has been gathered, the malware automatically feeds its findings into AI tools for analysis using OpenRouter, a model gateway platform that can be used to send prompts to multiple different AI providers.
Volta begins this process with Anthropic’s Claude Opus 4.6. If it is blocked by the model’s guardrails, the infostealer malware refers to Kimi K2, an open-weight model by China’s Moonshot AI. If it is unsuccessful again, the model falls back on Google’s Gemini 2.5 Flash.
The malware was observed to send a 240-word prompt, including bullet points and a numbered list, as part of its instructions to the LLM used to analyse the stolen data. According to the research, the prompt reads: “You are a forensic intelligence analyst drafting a target assessment from a structured evidence bundle,” the Volta prompt says. It further instructs the chatbot to produce an “executive summary” about the person, details of what they do, “what they’re worth,” and a summary of “their opsec.”
It further says that the chatbot should “connect dots across fields,” for example, checking whether someone’s Wi-Fi password matches their last name. “Go deep, not wide,” the prompt finally adds.
This is far from the first instance of hackers using LLMs for coding tasks or analysing troves of stolen information. Recently, researchers at threat intelligence firm Crowdstrike said that they had seen four distinct hacking groups with varying sophistication using AI tools to compromise dozens of targets around the world, including government entities and businesses in health care, retail, and travel.
https://share.google/w4lBQ0wibJEA4LT0C