Infostealer malware has long been a staple in the cybercriminal arsenal, responsible for countless data breaches by pilfering credentials, financial data, and personal information. Recent high-profile incidents, including the **Snowflake**-linked breaches affecting **AT&T** and **Ticketmaster**, and the theft of **Disney** data, underscore the pervasive threat posed by these tools. ### The Rise of Volta-Autodoxer Exclusive research shared with Kernel Panic by **Cisco Talos** security researchers, including **Ryan Fetterman**, details a new strain of infostealer dubbed **Volta-Autodoxer**. What sets Volta apart is its integration of AI capabilities, allowing it to automatically profile victims and quickly surface the most valuable targets and their sensitive data. Internally, the malware refers to itself as "Volta-Autodoxer," highlighting its autonomous dox-generating potential. Volta's core infostealer functions are robust, designed to cast a wide net for data collection. It targets passwords stored in browsers, **Microsoft** OAuth tokens, cookies, payment card data, and cryptocurrency wallet seed phrases. Furthermore, it actively sweeps for sessions in popular platforms like **Discord**, **Telegram**, **Steam**, and **Roblox**. ### Deep Profiling and AI Analysis After an initial sweep, Volta performs a deeper dive, leveraging its first-round findings to build a comprehensive victim profile. By analyzing central accounts like **Gmail**, the malware gathers information on location and habits, drawing insights from data such as receipts and order history from services like **UberEats** and **DoorDash**. Once this extensive data collection is complete, Volta feeds its findings into AI tools for analysis. It uses **OpenRouter**, a service capable of sending prompts to multiple AI providers. The malware defaults to **Anthropic's Claude Opus 4.6** for its requests. However, anticipating potential guardrail blocks, Volta is built with fallbacks to the Chinese open-weight **Moonshot AI Kimi K2** and, if that fails, **Google's Gemini 2.5 Flash**. This strategy of using fallbacks and cost-effective, older-generation models is a common tactic among threat actors seeking reliability and stealth. ### The AI Prompt: A Forensic Analyst's Role The creators of Volta included a sophisticated 240-word prompt for the LLMs, instructing them to act as a "forensic intelligence analyst drafting a target assessment from a structured evidence bundle." The prompt directs the chatbot to produce an "executive summary" about the victim, detailing their activities, their "worth," and an assessment of "their opsec." It even instructs the AI to "connect dots across fields," such as checking if a Wi-Fi password matches a last name, emphasizing a "deep, not wide" analysis approach. **Ryan Fetterman** notes that the prompt is carefully crafted to avoid overtly malicious language, yet it anticipates and plans for potential model refusals by incorporating a cascading failover to more permissive AI models. Importantly, Volta can still operate effectively without its AI components, indicating that the AI integration is an enhancement rather than a core dependency. ### A Broader Trend in Cybercrime While some low-level cybercriminals have complained about "AI slop" flooding forums, security researchers are increasingly observing more sophisticated uses of LLMs by threat actors. **CrowdStrike** researchers, for instance, have identified at least four distinct hacking groups – operating in Chinese, Spanish/English, Indonesian, and Russian – leveraging AI tools to compromise government entities and businesses in various sectors globally. Fetterman suggests that Volta may have been developed for sale to a range of attackers rather than for a single actor's campaigns. This AI-powered expansion of traditional infostealer capabilities signals a concerning future where advanced functionalities become accessible to a broader spectrum of cybercriminals, enabling faster identification of high-value targets and more efficient exploitation of stolen credentials before they expire or are changed. "If you're able to identify your high-value targets faster, you probably have a better chance of using their credentials or authenticating using stolen tokens more often than maybe you would have if you had to do that triage yourself," Fetterman stated, underscoring the escalating threat landscape. "We're seeing more advanced capabilities accessible to lower-level sophistication attackers. It's really interesting and disturbing."