Malware uses AI to rank stolen identities by what they are worth

A stealer that asks an AI what to do next

Security researchers at Cisco Talos have documented a new Windows infostealer that does not stop after it takes a victim's passwords. Once it has collected credentials, session tokens and wallet data, the malware, which calls itself Volta-Autodoxer, bundles the material and sends it to large language models for analysis, according to research shared exclusively with WIRED.

The AI does not help the malware steal. It helps the operator decide which stolen identity is worth acting on first. The bundling and ranking layer is the new part; the theft underneath is a mature, conventional infostealer. It also lands in a year of AI-linked security failures, including the ChatGPT shared-link flaw covered in our report on the ChatGPT shared-link RCE.

What the dossier contains

The haul is broad: browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles and screenshots. It also takes live sessions for Discord, Telegram, Steam and Roblox, which is one reason Talos describes the malware as aimed at younger users with busy digital lives.

The second pass is where the profiling begins. Using access to a central account such as Gmail, the malware hunts for purchase receipts to corroborate a home address, pulls UberEats and DoorDash order history, and enriches Discord accounts through stolen tokens. Talos says the resulting bundle includes geolocation, employer and employer domain, an inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata and even a live valuation of a Roblox account. Stolen cloud and API keys of the kind this malware collects have already caused breaches, as our account of the Northflank API-key breach describes.

The prompt and the fallback chain

The bundle is serialised and posted to OpenRouter, a service that routes requests to several AI providers. Wired reported that Volta defaults to Anthropic's Claude Opus 4.6, and that the prompt runs to about 240 words. Talos reports that the system prompt instructs the model to act as "a forensic intelligence analyst drafting a target assessment", and that the required output includes a section titled "WHAT THEY'RE WORTH", which ranks valuables by monetisation on a low, medium or high tier, and a section on "THEIR OPSEC" covering the victim's security posture and password hygiene.

The model is also told to "go deep, not wide" and to connect sparse data points, for example by checking whether a person's Wi-Fi password matches their surname. The malware sets a low temperature of 0.2, which points to a preference for consistent, repeatable output rather than creative answers.

The engineering assumes refusal. Volta checks each response for phrases such as "I can't" or "I'm not able" and, if it finds them, fails over to a chain of up to three models, including the open-weight Moonshot AI Kimi K2 and Google's Gemini 2.5 Flash. Talos says the fallback design implies the operator expected guardrails to get in the way and planned for cheaper, more permissive models as backups.

What the researchers say they found, and did not

Talos flagged the malware through a new research framework called CAIRN, built to identify tools that add AI capabilities to established attack techniques. Ryan Fetterman, a security researcher at Talos, said the AI calls sit on top of a stealer that "casts a pretty wide net" and still works without any model at all.

The researchers say the malware is self-deleting and leaves no attacker-owned infrastructure behind. They also say they did not track whether Volta has been used in the wild, which means the finding is a capability report rather than evidence of an active campaign.

Why a ranking layer matters

Infostealers have powered some of the largest breaches in recent years because stolen credentials and cookies let attackers log in rather than break in. What changes here is triage. Tokens expire and passwords get changed, so the value of a stolen identity decays; a model that sorts a thousand victims by monetisation value lets an operator spend the next hour on the few that are worth it.

Fetterman said that faster identification of high-value targets probably means stolen credentials and tokens get used more often than they would if the operator had to do the sorting by hand. He also said Volta contains clues that it may have been built to sell to a range of attackers rather than for one actor's campaigns.

The wider pattern

The case fits a broader shift in which criminal groups use commercial AI services as labour rather than as a weapon. WIRED reported that CrowdStrike researchers had seen four distinct hacking groups, operating in Chinese, Spanish and English, Indonesian, and Russian, using AI tools to compromise dozens of targets including government entities and businesses in health care, retail and travel.

That division of labour is the point: the model writes the assessment, the malware does the collection and the human decides what to do with the result. Security teams that only look for malicious model behaviour will miss this, because the model is not being asked to do anything obviously hostile; it is being asked to be a good analyst. The same pattern of trusted channels being abused has shown up in AI coding tools, as our report on the trojanized Claude Code extension sets out.

What to watch

The practical question for defenders is whether AI-assisted triage shows up in breach timelines. If stolen credentials are used faster after an infection, the window for detecting an infostealer and rotating credentials shrinks, and the case for hardware-backed authentication and short-lived tokens gets stronger.

The other question is whether the model providers treat this as abuse. Volta's fallback chain suggests the operators expect at least some refusals; how consistently those refusals happen will shape whether the next version bothers with a single model or keeps a longer list.