New malware uses AI to profile the people it infects
Cisco Talos found an infostealer called Volta-Autodoxer that sends stolen data to AI models to build a profile of each victim and rank the best targets.
The facts
- According to Wired, Cisco Talos researchers found an infostealer called Volta-Autodoxer that sends a dossier of stolen data to commercial AI models, which assess the victim and flag high-value targets.
- It collects browser passwords, Microsoft OAuth tokens, cookies, payment cards and crypto wallet seed phrases, plus active Discord, Telegram, Steam and Roblox sessions.
- It sends requests through OpenRouter, defaulting to Anthropic's Claude Opus 4.6, with fallbacks to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash in case the first model refuses.
- Talos did not track whether Volta has been used in the wild, and the malware still works if the AI calls fail.
Case notes · Danny's take
Why it matters
Infostealers already feed many of the biggest breaches. Now AI does the sorting that attackers used to do by hand. That matters because stolen tokens expire and passwords get changed, so speed decides whether a stolen login still works. The worrying part is the lower barrier: less skilled criminals get tools that once needed a skilled analyst. Not a new kind of malware. A faster one.
For traders
If you hold crypto in a browser wallet on the same machine you use for Discord, Telegram or gaming, you are the kind of target this malware sweeps for. Watch for security advisories on seed phrase theft, and check your own wallet activity regularly rather than waiting for a headline.
For builders
Assume that any credential or token sitting on a user's device can be found and ranked within minutes. Shorter token lifetimes, device-bound sessions and hardware wallet prompts reduce the value of what an infostealer grabs. If you run an AI API, expect attackers to probe your guardrails and plan for abuse, not just normal use.
Not financial advice. Do your own investigation.
This story was summarised with AI from Wired's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
Danny Walter
Founder of Moon Republic, Volt Terminal and Moon Republic Academy. Author of The Market Is a Crime Scene and After the Applause.