New malware uses AI to profile and prioritize high-value hacking targets

The rise of AI-powered profiling

Security researchers have identified a new strain of infostealer malware named Volta-Autodoxer. This type of malware is designed to live on infected machines to grab sensitive information like passwords, cookies, and credit card data. While infostealers are not new, this version adds a layer of artificial intelligence to help hackers manage their loot.

The malware is designed to cast a wide net to collect as much data as possible from a victim's device. It gathers everything from browser-stored passwords to Microsoft OAuth tokens and cryptocurrency wallet seed phrases. Once it collects this data, it compiles it into a serialized dossier for further processing.

As reported by Wired, the malware then sends this dossier to various large language models (LLMs). It specifically asks these models to act like intelligence analysts to produce structured assessments of the victims. This allows hackers to quickly surface the highest-value targets from a massive pool of stolen information.

}

How the malware analyzes victims

Volta-Autodoxer performs a two-step sweep of a victim's digital life. The first round gathers basic credentials and active sessions from platforms like Discord, Telegram, Steam, and Roblox. The second round goes deeper by searching for central accounts, such as Gmail, to build a fuller picture of the user's habits.

By looking through these central accounts, the malware finds receipts and order histories from services like UberEats and DoorDash. This data helps the AI determine the victim's location and daily routines. The goal is to move beyond simple password theft to a comprehensive understanding of the person's identity.

To perform this analysis, the malware uses a service called OpenRouter, which allows it to send prompts to different AI providers. It defaults to Anthropic’s Claude Opus 4.6 but includes fallbacks to other models like Moonshot AI Kimi K2 and Google’s Gemini 2.5 Flash. These fallbacks ensure the malware can still function if a specific model's safety guardrails block the request.

}

The 'intelligence analyst' prompt

The creators of Volta-Autodoxer included a specific 240-word prompt to guide the AI's behavior. This prompt uses a numbered list and bullet points to instruct the chatbot to draft a target assessment. It tells the AI to provide an executive summary of the person and detail what they do and what they are worth.

The instructions ask the chatbot to connect dots across different fields of data. For example, the prompt directs the AI to check if a person's Wi-Fi password matches their last name. It explicitly tells the AI to "Go deep, not wide" to find the most significant information about the victim's security posture.

Security researcher Ryan Fetterman noted that the prompt is carefully crafted to avoid sounding overtly malicious. However, it is designed with the expectation that the AI might refuse the first request. The malware is built to cascade through different models until it finds one that will comply with the instructions.

}

Who is being targeted

The malware appears to be specifically geared toward targeting younger internet users who maintain robust digital lives. It seeks out active sessions on gaming and social platforms like Roblox and Steam. By capturing these sessions, hackers can gain immediate access to the victim's online accounts.

While the malware is sophisticated, researchers believe it may have been built to be sold to a variety of different attackers. It is not necessarily tied to one specific hacking group or campaign. This means a wide range of cybercriminals could potentially use this tool to automate their data triage process.

The use of AI in this context allows lower-level attackers to achieve results that previously required more expertise. By automating the analysis of stolen data, hackers can identify high-value targets faster. This speed is critical because authentication tokens often expire and passwords can be changed by the user.

}

The future of AI malware

The appearance of Volta-Autodoxer signals a shift in how hackers use commercial AI tools. While some criminals complain about AI-generated spam, others are using LLMs for coding tasks and analyzing stolen data. This trend shows that AI is becoming a standard tool for enhancing the capabilities of established malware types.

The research was conducted using the CAIRN framework, which is specifically built to identify hacking tools that incorporate AI. While researchers have not yet tracked Volta in the wild, its existence highlights a growing trend. It demonstrates how easily accessible AI can be used to make cyberattacks more invasive and efficient.

Fetterman warned that these advanced capabilities are becoming accessible to attackers with lower levels of sophistication. This makes it easier for them to prioritize targets and use stolen credentials more effectively. The evolution of infostealers suggests that the threat landscape will continue to become more automated and harder to defend against.

}