Cisco Talos Finds Volta Infostealer Using AI Models to Profile Victims

Cisco Talos researchers identified Volta-Autodoxer, an infostealer that uses commercial AI models to profile victims and surface valuable targets, according to WIRED. The malware collects passwords, authentication tokens, cookies, payment cards, cryptocurrency wallet seed phrases and active sessions from services including Discord, Telegram, Steam and Roblox.

Volta-Autodoxer performs a deeper search using data from central accounts such as Gmail. It can examine receipts and order histories to infer a victim's identity, location and habits, then sends the collected information through OpenRouter for analysis.

The malware first requests Claude Opus 4.6 from Anthropic, with Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash serving as fallback models. Its prompt asks the model to produce a structured assessment covering the victim's activities, estimated worth and security practices. Talos researcher Ryan Fetterman said Talos did not track whether Volta has been used in the wild, and that the malware appears to have been built for sale to a range of attackers. "We’re seeing more advanced capabilities accessible to lower-level sophistication attackers," he said.