Cisco Talos found infostealer malware that asks AI chatbots to size up what a victim is worth. Here is who is exposed and what to do about it.
Security researchers at Cisco Talos have found a new password-stealing program that uses AI to profile the people it infects. It is called Volta-Autodoxer, after how the malware refers to itself. After stealing a person's data, it asks AI models to write a report on who the victim is and "what they're worth." Talos did not track whether it has been used in real attacks yet.
Infostealers are not new. They are programs, often hidden in counterfeit software, that grab usernames, passwords, cookies, card numbers and sign-in tokens from an infected computer. The article notes that logins collected this way have fueled many big data breaches, and that these programs have stolen hundreds of millions of credentials in recent years.
Volta adds a new step. It sweeps the device, then digs deeper using what it found. By going through a Gmail or other central account, it can learn a victim's location and habits from receipts and order history on services like UberEats and DoorDash. It then sends that bundle to AI tools through a service called OpenRouter.
Its default is Anthropic's Claude Opus 4.6. If that model refuses, it falls back to Moonshot AI's Kimi K2, then Google's Gemini 2.5 Flash. The instructions ask the AI to act like an intelligence analyst. The malware still works without the AI.
Volta seems aimed at younger people with busy digital lives. It collects passwords saved in browsers, Microsoft sign-in tokens, payment cards and crypto wallet recovery phrases. It also takes active Discord, Telegram, Steam and Roblox sessions. A Talos researcher said the malware casts a wide net for what it collects.
The speed is the concern. Passwords get changed and sign-in tokens expire. If attackers can quickly spot the most valuable victims, they are more likely to use stolen access before it goes stale. The researcher said advanced tools are reaching less skilled attackers, which he called "interesting and disturbing."
Nothing in the research says Volta is spreading widely right now. Infostealers are often hidden in counterfeit software, so people who stick to official sources face less exposure. Clues in the code suggest it may have been built to sell to various attackers, so it could show up more than once.
The steps are in the alert box above. They come down to getting software only from official places, keeping passwords and cards out of the browser, and locking down your email, since a hacked inbox reveals orders, location and habits.
Talos found Volta with a new framework called CAIRN, built to spot hacking tools that use AI. Other researchers have also seen hacking groups using AI to break into targets, including government and business networks. Expect more stealers to borrow the idea. Whether Volta is being used against real victims is still unknown.
Download software only from official sources and keep passwords and cards out of your browser, since stolen logins can now be ranked by value fast.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
