VOLTA Infostealer Leverages AI for Advanced Victim Prioritization
The VOLTA-AUTODOXER infostealer now employs an AI integration layer to analyze and prioritize victims for monetization, marking a significant evolution in cybercrime tactics.
A sophisticated infostealer, self-named VOLTA-AUTODOXER, has emerged with a novel AI-powered victim prioritization system. This malware goes beyond traditional credential harvesting by integrating with a large language model (LLM) to act as a forensic intelligence analyst, assessing the monetary value and operational security of its victims. This approach allows attackers to cast a wide net, collect extensive data, and then use AI to efficiently identify the most lucrative targets.
VOLTA-AUTODOXER is a self-deleting Windows infostealer that collects a comprehensive array of sensitive information. This includes browser passwords, session cookies, payment card details, cryptocurrency wallet seed phrases, and credentials for platforms like Discord, Telegram, Steam, and Roblox. It also targets Microsoft OAuth tokens, SSH keys, cloud provider credentials, Wi-Fi profiles, and screenshots. The malware then compiles this data into a structured "evidence bundle" that includes geolocation, home address, employer information, inferred birth year, and even live valuations of Roblox accounts.
The enrichment process is particularly noteworthy. VOLTA-AUTODOXER leverages stolen session tokens to further enhance the evidence bundle. For instance, it can search a victim's Gmail for purchase receipts to confirm a home address, extract order history from food delivery services like UberEats and DoorDash, and enrich Discord account details. This deep dive into a victim's digital life provides attackers with a highly detailed profile.
The core innovation lies in how VOLTA-AUTODOXER utilizes an LLM. The compiled evidence bundle is sent to OpenRouter with a system prompt instructing the AI to act as a "forensic intelligence analyst drafting a target assessment." The AI is tasked with ranking valuables by monetization potential (low/medium/high) and assessing the victim's operational security (OpSec) and password hygiene. This transforms raw stolen data into a prioritized, actionable dossier for the attacker.
To ensure resilience, VOLTA-AUTODOXER employs a multi-model architecture. If the primary LLM refuses to perform the assessment, the malware fails over to a chain of up to three fallback models, including options like anthropic/claude-opus-4.6, moonshotai/kimi-k2, and google/gemini-2.5-flash. The low temperature setting (0.2) indicates a focus on deterministic and consistent output, crucial for reliable analysis.
The prompt given to the AI encourages it to make connections between disparate data points, such as linking a victim's name or university to patterns in their passwords. This allows the AI to infer valuable insights beyond what is directly scraped, extending the potential monetization value of the stolen information.
Beyond its AI capabilities, VOLTA-AUTODOXER boasts robust stealer functionalities. It can crack cryptocurrency vault files inline and extracts all saved Wi-Fi passwords in plaintext. The malware's ability to perform live enrichment using stolen session tokens, combined with its AI-driven prioritization, represents a significant advancement in the capabilities of modern infostealers and a concerning trend in the professionalization of cybercrime.