🕵️Volta-Autodoxer Malware Adds AI to Profile Victims and Pick High-Value Targets

Your credentials now get an AI analyst before they get stolen

Hackers just gave infostealer malware an AI analyst. The new strain, dubbed Volta-Autodoxer, bundles everything it steals into a dossier and asks a language model to profile the victim. Not a dumb dump of passwords anymore. A ranked assessment of who's worth robbing next. Why you should care: infostealers already grab usernames, passwords, auth tokens, cookies and credit card data from infected laptops. Your dev machine is full of those. Tokens for GitHub, AWS, Slack and your cloud console are exactly what this tool is built to surface. If you keep long-lived API keys in .env files or browser sessions open for weeks, this is your problem now. The details: Volta sends its requests through OpenRouter, defaults to Anthropic's Claude Opus 4.6, and falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash. A 240-word prompt tells the model to act like an intelligence analyst, connect dots across fields, and flag inconsistencies. The malware still works without the AI, so the AI is an upgrade, not a requirement. Worth watching: CrowdStrike has already tracked four hacking groups using AI tools against dozens of targets. Volta's configurable model fallbacks suggest it was built to sell, not to serve one campaign.