MisuseSerious4 sourcesFirst seen
Infostealer Hires an AI Intern to Dig Up Dirt on Its Victims
Ourtake
Malware that profiles its victims and ranks them by value, with backup models lined up in case the first one balks at the job.
What happened
Cisco Talos researchers found an infostealer called Volta-Autodoxer that sends stolen victim data to commercial AI models to build profiles and rank high-value targets. Talos did not determine whether the malware has been used in the wild, and it works without the AI calls.
Sources
- Wired · Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims (opens in a new tab)
- blog.talosintelligence.com · Malware uses LLMs to rank victims by how much they're worth (opens in a new tab)
- tomshardware.com · New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely (opens in a new tab)
- thehackernews.com · New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value (opens in a new tab)