conv.

All stories
SecurityQuiet 9d · day 11

Volta-Autodoxer: AI-enhanced malware profiles victims by mining Gmail, Discord data

Cisco researchers uncover new infostealer that uses commercial LLMs to automatically identify high-value targets and build detailed dossiers on victims.

newest coverage 8d agosummary written 9d ago11 pieces1 comments NewswiresGoogle NewsMastodonReddit

What to know

  • Volta-Autodoxer combines traditional infostealer capabilities with AI-powered victim assessment, using commercial LLMs from Anthropic, Google, and Moonshot AI to automatically prioritize targets based on stolen data.
  • The malware scrapes Gmail, Discord, Telegram, Steam, and Roblox sessions, plus payment cards and crypto wallets, enabling hackers to build detailed victim profiles including location and shopping habits.
  • AI integration compresses attack timelines and makes sophisticated victim targeting accessible to lower-skilled attackers, increasing the risk of mass credential harvesting and account compromise.
  • The discovery demonstrates how established malware types are being weaponized with LLM capabilities, even as commercial AI providers implement safety guardrails against misuse.

“We're seeing more advanced capabilities accessible to lower-level sophistication attackers. It's really interesting and disturbing […] If you're able to identify your high-value targets faster, you probably have a better chance of using their credentials or authenticating using stolen tokens more often.”

Ryan Fetterman, Security researcher, Cisco Talos · Indian Express ↗

Cisco Talos Security research unitRyan Fetterman Security researcher, Cisco Talos

Volta-Autodoxer: AI-enhanced malware profiles victims by mining Gmail, Discord data
Indian Express

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 4 pieces in 3h at Nov 2, 12 AM; 11 pieces over 11 days (6 articles · 5 posts) Oct 31, 7 AM — 3 pieces · 3 articles — Google News 2, Newswires 1Oct 31, 10 AM — quietOct 31, 1 PM — quietOct 31, 4 PM — quietOct 31, 7 PM — quietOct 31, 10 PM — quietNov 1, 1 AM — quietNov 1, 3 AM — quietNov 1, 6 AM — quietNov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — 4 pieces · 3 articles · 1 post — Google News 2, Newswires 1, Mastodon 1Nov 2, 3 AM — 1 piece · 1 post — Reddit 1Nov 2, 6 AM — 2 pieces · 2 posts — Mastodon 2Nov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — 1 piece · 1 post — Reddit 1Nov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quiet 12
Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9now · 5:43 AM ET
  1. 2

    Indian Express details Volta-Autodoxer mechanics: Gmail scraping feeds data to LLM analysis

    Reporting reveals Volta scans browsers for passwords, OAuth tokens, cookies, and crypto seed phrases, then extracts Gmail and social media information to build victim profiles including location and eating habits. The malware feeds gathered data through OpenRouter to Anthropic's Claude, then falls back to Moonshot AI's Kimi K2 or Google's Gemini if blocked.

    “It's asking the model to act like an intelligence analyst and produce structured citation-backed assessment of the victim. It's like a prioritisation and analysis function.”
    — Ryan Fetterman
    1. 1 outlet VOLTA Malware Steals Gmail and Discord Sessions, Then Uses AI to Build Detailed Victim Profiles

      first by CyberSecurityNews, 9d ago

    • pluralistic@mamot.fr

      Black October is going to give way to Black November, Black December, Black 2027, and the Black 2030s - a string of cybersecurity catastrophes that will befall us until policymakers decide that keeping us safe is more important than making it easy for them to attack their chosen "bad guys." Here's a preview of Black November: there's a new strain…

      pluralistic@mamot.frMastodon9d agoview on Mastodon ↗
  2. 1 day quiet
  3. 1

    Cisco Talos researchers uncover Volta-Autodoxer malware using AI for victim profiling

    Researchers at Cisco's threat intelligence unit Talos identified a new AI-driven infostealer malware called Volta-Autodoxer using their CAIRN framework. The malware combines traditional stealing capabilities with AI-powered victim assessment, using commercial LLMs to prioritize targets.

    1. 2 outlets What is Volta-Autodoxer, new AI-enhanced malware profiling victims for hackers in seconds?

      first by The Indian Express, 9d ago · also Indian Express

    2. 1 outlet Volta malware raids your Gmail receipts, then asks an AI what you’re worth

      first by Martin Cid Magazine, 10d ago

    1 more claim →