Cybersecurity
Hackers Deploy AI-Powered Malware That Automatically Profiles and Prioritizes Victims
Researchers discovered a new infostealer malware variant that uses large language models to analyze stolen data and rank targets by value, making credential theft more efficient at scale.
WIRED — AI
Hackers have begun embedding artificial intelligence into information-stealing malware to automatically identify and rank their most valuable targets, according to fresh research from Cisco Talos disclosed exclusively to Wired's Kernel Panic newsletter. The malware, internally called "Volta-Autodoxer," represents a troubling convergence: traditional credential theft paired with machine learning-powered victim prioritization.
How the Malware Works#
Volta operates in two stages. First, it sweeps infected machines for sensitive data—browser passwords, authentication tokens, payment card details, cryptocurrency wallet recovery phrases, and active sessions across platforms like Discord, Telegram, Steam, and Roblox. The malware then performs a deeper reconnaissance pass by examining the victim's email account and digital footprint, mining receipts and purchase histories from services like UberEats and DoorDash to build a comprehensive profile.
Once the intelligence gathering phase completes, Volta packages its findings and sends them to commercial AI models via OpenRouter, a service that routes requests to multiple providers. The malware defaults to Anthropic's Claude Opus 4.6 but includes fallback options: Moonshot AI's Kimi K2 (a Chinese open-weight model) and Google's Gemini 2.5 Flash, suggesting developers anticipated model guardrails might block the initial request.
The AI is given detailed instructions—a 240-word prompt directing it to function as a "forensic intelligence analyst" producing an executive summary of the victim, their assets, operational security practices, and financial worth. According to Ryan Fetterman, the Cisco Talos researcher who discovered the malware, the prompt is "pretty carefully crafted not to imply anything overtly malicious," yet it clearly prepares for model refusals and cascading to more permissive alternatives.
Why This Matters#
The combination of automated data collection and AI-driven victim analysis streamlines the criminal workflow. Stolen credentials and authentication tokens have expiration dates; hackers who can rapidly identify high-value targets and exploit them quickly have a much better window to act before victims change passwords or revoke access. "It's really interesting and disturbing," Fetterman noted, pointing out that sophisticated attack capabilities are now accessible to lower-tier cybercriminals.
Infostealers have already been central to some of the largest breaches in recent years. Credential theft from these tools contributed to the Snowflake-linked incidents that compromised AT&T and Ticketmaster, as well as the theft of Disney's data. Across the industry, infostealer malware has been used to steal hundreds of millions of credentials.
