WIRED: Volta-Autodoxer profiles stolen data with commercial LLMs
Original title: Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims
Cisco Talos says it has not tracked real-world use; the stealer still functions if its optional AI calls fail.
WIRED reports Cisco Talos research on Volta-Autodoxer, an infostealer that compiles stolen credentials, tokens, cards, crypto seeds, and chat or game sessions into a dossier for commercial LLMs. Requests default to Anthropic’s Claude Opus 4.6 through OpenRouter, then fall back to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. A 240-word prompt asks for an executive summary, what the person is worth, and their operational security. Talos researcher Ryan Fetterman says clues suggest it may have been built for sale to multiple attackers.
Unconfirmed: Talos did not track whether Volta has been used in the wild, and a commercial-sale motive is only inferred.
- Talos flagged Volta with its CAIRN framework for AI-enabled hacking tools.
- A second pass uses Gmail and delivery accounts to infer location and habits.
- The prompt tells models to connect sparse fields, such as Wi-Fi passwords and names.
- Fetterman says lower-skilled attackers could triage high-value targets faster.
- CrowdStrike told WIRED it has seen four groups use AI against dozens of targets.
Impact: Credentials, tokens, cards, and personal details packaged for prioritization
- Vendors
- AnthropicGoogleMoonshot AI
- Malware
- Volta-Autodoxer
- Organizations
- Cisco TalosOpenRouterCrowdStrike
From the original article
4 min read at wired.com
Named “Volta-Autodoxer,” the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts.
By Lily Hay Newman, Matt Burgess · wired.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.