Malware Now Uses AI to Score Victims

Most infostealers stop at the theft. They grab passwords, session cookies, crypto seeds and keys, package it up, and ship it off to a buyer who then has to figure out what any of it is actually worth. A strain newly described by Cisco Talos researchers skips that last step, outsourcing the valuation itself to a large language model.

The malware is called VOLTA-AUTODOXER. According to Cisco Talos, it was identified through the Cognitive Artificial Intelligence Research Network (CAIRN), an open source cybersecurity research kit built to identify and track AI-powered malware. The researchers describe a four-stage operation: collect as much information as possible, hand it to an AI for assessment, exfiltrate the data to attacker-controlled infrastructure, and then delete itself from the victim's machine.

A familiar stealer at first glance

Cisco Talos did not disclose where the malware was found, how many devices it infected, or how it is being distributed. On the surface, the researchers said, it behaves like any other infostealer. It harvests browser passwords and cookies, payment card details, cryptocurrency wallet seed phrases, sessions for Discord, Telegram, Steam and Roblox, Microsoft OAuth tokens, SSH and cloud-provider keys, saved Wi-Fi profiles, and screenshots.

That list alone would make it a serious problem for any infected machine. Credentials and session tokens are the raw material of account takeover, and cloud keys and SSH credentials can open doors well beyond the individual user. But the collection stage is not where VOLTA diverges from the standard playbook.

Building a dossier on the person

What separates this strain is the structured evidence bundle it assembles about the human behind the keyboard. Beyond the credentials, VOLTA gathers the device's geographical location, home address, employer and employer domain, an inferred birth year, the last four digits of the victim's credit cards, Slack workspaces, document authorship metadata, indicators of iPhone backups, and a live valuation of the victim's Roblox account.

The home address is not taken on trust. According to the researchers, the malware moves on to Gmail looking for messages from UberEats and DoorDash in order to corroborate where the person actually lives. It is a small detail that says a lot about intent: this is not bulk credential harvesting, it is targeted profiling built from the everyday residue of a person's digital life.

Employer domain and Slack workspace data matter for a different reason. They help establish not just who the victim is, but where they work and what they might be able to reach. Document authorship metadata can reveal what projects a person touches. Taken together, the bundle is less a list of stolen logins than a short intelligence file.

The AI handoff

Once the bundle is assembled, VOLTA serializes it and POSTs it to OpenRouter, an AI infrastructure platform that gives users access to hundreds of LLMs through a single API. There, a model receives a prompt instructing it to behave as a “forensic intelligence analyst drafting a target assessment” — the task being to judge whether the stolen data is worth the trouble, and if so, how much.

The default model named in the source is Claude. If it declines to comply, the malware is reportedly instructed to fall back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash. If none of the models cooperate, the malware simply sends the raw data back to the attacker, typically through a Telegram channel.

The result is a ranked list of victims by value. The researchers connect that ranking to what appears to be the end goal: ransomware. Sorting targets by perceived worth lets an operator decide where to spend time and effort rather than treating every infection as equivalent.

“This suggests it’s a builder model: The author sells access, the customer provides their values, and the builder compiles a custom binary for each order,” Cisco Talos explains. “If VOLTA is indeed a commoditized malware, then the AI dossier capability isn't something the author invented for their own operations. It is a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments in their Telegram inbox.”

— Cisco Talos

Cleanup and a leftover debug file

After the assessment and exfiltration are complete, VOLTA is instructed to delete itself from the system, likely to cover its tracks. A separate file named volta_debug.txt is reported to remain behind, showing what was collected and whether the AI-powered assessment succeeded — a detail that could matter to anyone trying to determine after the fact what a compromised machine gave up.

Cisco Talos did not say how long the malware has been in circulation or whether it has been observed in real-world intrusions at scale. The researchers' account describes its mechanics and design rather than a confirmed campaign.

Why the builder design matters

The researchers believe VOLTA is built to be sold on the black market. Elements such as the Telegram channel and API keys are not hardcoded. Instead, the malware ships as a template with six swappable slots that are filled in at build time.

That architecture is what leads Cisco Talos to describe it as a builder model, in which a customer supplies their own configuration and receives a custom binary. If that reading is correct, the AI profiling capability would not be reserved for a single skilled crew. It would be a purchasable feature, available to buyers regardless of technical sophistication, delivered as ranked assessments in a Telegram inbox.

• Four stages in the operation: collection, AI assessment, exfiltration, self-deletion
• Three AI models named: Claude by default, with fallbacks to Kimi K2 and Gemini 2.5 Flash
• Six swappable slots in the malware template, filled at build time
• One leftover file: volta_debug.txt, recording what was collected and whether assessment succeeded

What the AI is and isn't doing

It is worth being precise about the model's role here. The AI is not breaking encryption, finding new vulnerabilities, or writing exploits. Its job is interpretation: reading a bundle of personal and financial detail and producing a judgment about the target's value. The underlying data is collected by conventional means that security teams already know how to defend against — credential theft, token harvesting, key extraction.

The prompt itself is notable for how mundane it is. Asking a general-purpose model to act as a forensic intelligence analyst drafting a target assessment does not require a jailbreak of unusual sophistication, and the malware's fallback chain suggests the author expected refusals and planned around them. If one model declines, another may not.

The researchers' framing points at a specific concern: that AI-powered victim profiling could become a commodity available to ransomware and cybercrime operators, rather than something confined to well-resourced groups. That is an assessment about where this design leads, not a claim that it has already happened at scale.

What to do if you suspect infection

The source offers direct guidance for anyone who believes a machine may be compromised. The steps are broad because the data taken is broad:

• Revoke or rotate all API keys and tokens
• Change all passwords
• Double-check cryptocurrency wallets and move any funds to a new wallet with a fresh seed

Because VOLTA targets cloud-provider keys, SSH credentials and Microsoft OAuth tokens alongside consumer accounts, the cleanup is not limited to changing a few passwords. Tokens and keys that were exposed remain valid until they are revoked, which is why rotation comes first in the guidance rather than last.

Where this leaves defenders

The uncomfortable part of the Cisco Talos account is not that a model was involved. It is that the model was pointed at a problem criminals previously solved with human judgment — and that the capability appears designed to be rented out. If a low-skilled buyer can obtain ranked, explained target assessments for every infection, the economics of choosing whom to attack shift toward the attacker. This suggests that the value of a single stolen credential may increasingly be judged not by the thief but by a model the thief never had to build.

For defenders, that could mean the stakes of a single infected endpoint are harder to gauge from the theft alone. The data that walked out the door may look unremarkable in isolation and look very different once something has sorted it, cross-referenced it and assigned it a price. The practical response the source points to is the same either way: treat exposed keys and tokens as spent, revoke them, and assume that whatever was on the machine has already been evaluated by someone — or something.