Cisco Talos discovers Volta-Autodoxer infostealer that uses commercial LLMs to automatically profile victims
Cisco Talos researchers identified a new infostealer, internally named Volta-Autodoxer, that feeds stolen victim data into commercial LLMs to build a prioritized, citation-backed dossier on each victim. The malware was flagged using Talos' new CAIRN framework, which is designed to identify hacking tools with AI capabilities. Talos did not track whether Volta has been used in the wild. Clues suggest it may have been built to be sold to a range of attackers rather than for a single actor's campaigns. The AI layer is optional, so the stealer still works without it.
Detalhes técnicos
- Collection: browser-stored passwords, Microsoft OAuth tokens, cookies, payment cards and crypto wallet seed phrases, plus active Discord, Telegram, Steam and Roblox sessions. The targeting appears geared toward younger users with extensive digital lives.
- Second-stage sweep: using first-round findings, it searches the victim's Gmail or another central account for receipts and order history from services such as UberEats and DoorDash, to infer location and habits.
- AI analysis: the serialized dossier is sent through OpenRouter to Anthropic Claude Opus 4.6 by default, with fallbacks to Moonshot AI Kimi K2 and then Google Gemini 2.5 Flash, apparently to work around model refusals.
- Prompt: a 240-word prompt casts the LLM as a "forensic intelligence analyst" producing an executive summary, the victim's value ("what they're worth") and an opsec assessment, and asks it to connect dots across fields (for example, Wi-Fi password versus last name). The prompt is worded to avoid overtly malicious language.
- Context: infostealer-sourced credentials have driven major breaches, including the Snowflake-linked incidents (AT&T, Ticketmaster) and the Disney data theft. CrowdStrike separately reported four hacking groups using AI tools to compromise dozens of targets worldwide.
Remediação
The article gives no specific remediation guidance. Because the purpose is faster triage of high-value accounts and reuse of stolen tokens, the practical risk is token and credential reuse before expiry or password changes.
Linha do tempo
-
Cisco Talos discovers Volta-Autodoxer infostealer that uses commercial LLMs to automatically profile victims
ler a análise desta fonte ocultar
Cisco Talos researchers identified a new infostealer, internally named Volta-Autodoxer, that feeds stolen victim data into commercial LLMs to build a prioritized, citation-backed dossier on each victim. The malware was flagged using Talos' new CAIRN framework, which is designed to identify hacking tools with AI capabilities. Talos did not track whether Volta has been used in the wild. Clues suggest it may have been built to be sold to a range of attackers rather than for a single actor's campaigns. The AI layer is optional, so the stealer still works without it.
Technical Details
- Collection: browser-stored passwords, Microsoft OAuth tokens, cookies, payment cards and crypto wallet seed phrases, plus active Discord, Telegram, Steam and Roblox sessions. The targeting appears geared toward younger users with extensive digital lives.
- Second-stage sweep: using first-round findings, it searches the victim's Gmail or another central account for receipts and order history from services such as UberEats and DoorDash, to infer location and habits.
- AI analysis: the serialized dossier is sent through OpenRouter to Anthropic Claude Opus 4.6 by default, with fallbacks to Moonshot AI Kimi K2 and then Google Gemini 2.5 Flash, apparently to work around model refusals.
- Prompt: a 240-word prompt casts the LLM as a "forensic intelligence analyst" producing an executive summary, the victim's value ("what they're worth") and an opsec assessment, and asks it to connect dots across fields (for example, Wi-Fi password versus last name). The prompt is worded to avoid overtly malicious language.
- Context: infostealer-sourced credentials have driven major breaches, including the Snowflake-linked incidents (AT&T, Ticketmaster) and the Disney data theft. CrowdStrike separately reported four hacking groups using AI tools to compromise dozens of targets worldwide.
Remediation
The article gives no specific remediation guidance. Because the purpose is faster triage of high-value accounts and reuse of stolen tokens, the practical risk is token and credential reuse before expiry or password changes.