11:00Machine-translated from Azerbaijani by AIRead in Azerbaijani
Cisco Talos Finds Malware That Uses AI to Create Victim Profiles
Cybersecurity researchers have discovered new information-stealing malware called “Volta-Autodoxer.” The program uses artificial intelligence to analyze the data it collects and create a profile for each victim. It then prioritizes targets that appear more valuable to criminals. “Cisco Talos” found the program using its “CAIRN” system, which detects AI-powered attack tools. However, it has not yet been confirmed that “Volta-Autodoxer” has been used in real-world attacks.
“Volta” collects passwords stored in browsers, OAuth tokens used to access “Microsoft” accounts, cookies, payment card information, and recovery phrases for cryptocurrency wallets. The program can also hijack active sessions on “Discord,” “Telegram,” “Steam,” and “Roblox.” This type of malware has stolen hundreds of millions of login credentials in recent years. The “Snowflake”-related data breaches that affected “AT&T” and “Ticketmaster,” as well as the theft of 1 TB of “Disney” data, have been linked to such credentials. After collecting the initial data, “Volta” conducts a more detailed search. It checks primary accounts such as “Gmail” to create a broader profile of where the victim lives, their habits, and their purchase history. To do this, it reviews “UberEats” and “DoorDash” receipts, as well as order histories. Finally, it sends all the data in the form of an organized dossier to artificial intelligence models that analyze text. This reduces the need for criminals to investigate each victim individually. The data is analyzed through “OpenRouter,” which sends requests to various artificial intelligence services. “Volta” first turns to “Anthropic”’s “Claude Opus 4.6” model. If the model blocks the request, the program tries “Moonshot AI”’s “Kimi K2” model, followed by “Google”’s “Gemini 2.5 Flash” model. Even if it cannot connect to an artificial intelligence service, it continues to operate as conventional information-stealing malware. The program’s 240-word prompt asks the language model to prepare a summary about the victim that would guide criminals. This includes an assessment of the person’s activities, financial value, and security habits. The model also looks for connections among different pieces of information. For example, it checks whether the wireless network password matches the victim’s surname. According to the researchers, the prompt is written in a way that does not reveal an overtly criminal intent. The structure of the code indicates that “Volta” may have been developed for sale to various attackers.
“Volta” collects passwords stored in browsers, OAuth tokens used to access “Microsoft” accounts, cookies, payment card information, and recovery phrases for cryptocurrency wallets. The program can also hijack active sessions on “Discord,” “Telegram,” “Steam,” and “Roblox.” This type of malware has stolen hundreds of millions of login credentials in recent years. The “Snowflake”-related data breaches that affected “AT&T” and “Ticketmaster,” as well as the theft of 1 TB of “Disney” data, have been linked to such credentials. After collecting the initial data, “Volta” conducts a more detailed search. It checks primary accounts such as “Gmail” to create a broader profile of where the victim lives, their habits, and their purchase history. To do this, it reviews “UberEats” and “DoorDash” receipts, as well as order histories. Finally, it sends all the data in the form of an organized dossier to artificial intelligence models that analyze text. This reduces the need for criminals to investigate each victim individually. The data is analyzed through “OpenRouter,” which sends requests to various artificial intelligence services. “Volta” first turns to “Anthropic”’s “Claude Opus 4.6” model. If the model blocks the request, the program tries “Moonshot AI”’s “Kimi K2” model, followed by “Google”’s “Gemini 2.5 Flash” model. Even if it cannot connect to an artificial intelligence service, it continues to operate as conventional information-stealing malware. The program’s 240-word prompt asks the language model to prepare a summary about the victim that would guide criminals. This includes an assessment of the person’s activities, financial value, and security habits. The model also looks for connections among different pieces of information. For example, it checks whether the wireless network password matches the victim’s surname. According to the researchers, the prompt is written in a way that does not reveal an overtly criminal intent. The structure of the code indicates that “Volta” may have been developed for sale to various attackers.