Cisco Talos finds Volta malware uses LLMs to profile victims automatically

Cisco Talos researchers have uncovered a new strain of infostealer malware that uses large language models to automatically profile victims. The tool, internally referred to as Volta-Autodoxer, represents a shift in how hackers process stolen data.

The evidence

Ryan Fetterman, a security researcher at Cisco Talos, shared findings exclusively with Kernel Panic about the malware’s capabilities. The researchers used their new CAIRN framework to identify hacking tools that incorporate artificial intelligence. Fetterman described Volta as a mature stealer that casts a wide net for data collection. The malware compiles collected information into a serialised dossier. It then sends this dossier to multiple large language model instances. The system prompts the models to act like intelligence analysts. The output is a structured, citation-backed assessment of the victim. This process functions as a prioritisation and analysis tool for attackers.

The decision

The malware targets specific types of digital assets commonly held by younger internet users. It sweeps for passwords stored in browsers and Microsoft OAuth tokens. It also captures cookies, payment card details and crypto wallet seed phrases. The tool actively looks for sessions on Discord, Telegram, Steam and Roblox. After the initial sweep, the malware performs a second, deeper pass using the first-round findings. This two-stage approach allows for more comprehensive data harvesting before the AI analysis begins.

What to make of it

Researchers noted that infostealers are often hidden inside counterfeit software distributed to users. These tools have historically been linked to major data breaches involving companies like AT&T, Ticketmaster and Disney. Hackers typically use login details gathered by such malware to access target accounts. The addition of AI functionality allows for faster identification of high-value targets from the stolen troves. However, Cisco Talos did not track whether Volta-Autodoxer has been used in the wild. The findings remain based on the malware’s internal structure and capabilities.

In practice

Startup founders should note that this malware specifically targets active sessions on platforms like Discord and Roblox. The AI component automates the profiling of victims to surface high-value information quickly. Access to this malware is not yet confirmed in active wild attacks according to Cisco Talos.reported The tool relies on users downloading counterfeit software or falling for other distribution methods. Limitations include the current lack of evidence for wild deployment. Users should verify software sources carefully. The malware’s ability to generate structured assessments means stolen data is processed more efficiently. This reduces the manual effort required by attackers to find useful credentials. Founders should monitor for signs of compromised session tokens.