VOLTA-AUTODOXER Malware Leverages AI for Victim Profiling

• •VOLTA-AUTODOXER uses AI to rank victims by asset value after data theft.
• •The malware operates without attacker-owned infrastructure, relying on third-party services.
• •It enriches victim profiles by accessing personal accounts to gather additional data.

The VOLTA-AUTODOXER malware, identified by Cisco Talos, utilizes large language models (LLMs) to rank victims based on the monetization value of their stolen data. This self-deleting Windows infostealer collects a wide range of sensitive information, including login credentials, payment card details, and personal data, and assembles it into structured evidence bundles. The malware operates without any attacker-owned infrastructure, relying on third-party endpoints for its operations. After gathering data, it enriches the victim profiles by accessing their accounts, such as Gmail and Discord, to corroborate information and assess security postures. The AI component acts as an intelligence analyst, creating prioritized dossiers of victims' assets. The malware's novel approach marks a significant evolution in cybercrime tactics, focusing on automated victim profiling and targeting high-value individuals. As of now, there are no reports of or public proof-of-concept code.