Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims

Save this storySave this storyWelcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here.

保存此报道。欢迎阅读《Kernel Panic》，这是由 Lily Hay Newman 和 Matt Burgess 撰写的每周通讯，带您深入了解隐私与数字安全的新世界。如需每周在收件箱中接收此通讯，请在此注册。

New research shared exclusively with Kernel Panic shows that hackers have started adding AI functionality into a new strain of infostealer malware, making it possible for the system to automatically profile victims and quickly surface the highest value targets and their information. Dubbed “Volta-Autodoxer” because of how the malware refers to itself internally, the finding by Cisco Talos researchers sheds light on the ways that commercial LLMs are being used to augment and enhance the capabilities of established types of malware.

独家分享给《Kernel Panic》的最新研究显示，黑客已开始将人工智能功能添加到一种新型信息窃取恶意软件中，使系统能够自动对受害者进行画像，并快速筛选出高价值目标及其信息。由于该恶意软件在内部将其称为“Volta-Autodoxer”，思科 Talos 研究人员的这一发现揭示了商业大语言模型（LLM）正被用于增强和提升现有恶意软件的能力。

Often hidden in counterfeit software, infostealers are designed to live up to their name, grabbing usernames, passwords, authentication tokens, cookies, credit card data, and more from infected machines. Many of the biggest data breaches in recent years—from the widespread Snowflake-linked breaches that included AT&T and Ticketmaster to the theft of a terabyte of Disney data—have resulted from hackers accessing targets using login details gathered by infostealers. Overall, the malware has been used to steal hundreds of millions of credentials in recent years.

信息窃取软件通常隐藏在伪造软件中，正如其名，旨在从受感染的机器中窃取用户名、密码、身份验证令牌、Cookie、信用卡数据等。近年来许多重大的数据泄露事件——从涉及 AT&T 和 Ticketmaster 的广泛 Snowflake 相关泄露，到迪士尼一 TB 数据的失窃——都是黑客利用信息窃取软件收集的登录凭据访问目标所致。总体而言，近年来该类恶意软件已被用于窃取数以亿计的凭据。

“Volta is pretty mature as a stealer. It casts a pretty wide net for what it collects,” says Ryan Fetterman, a security researcher at Cisco Talos. “It compiles all of those things together, ultimately producing a serialized dossier that it can send to a couple LLM models. It’s asking the model to act like an intelligence analyst and produce structured citation-backed assessment of the victim. It’s like a prioritization and analysis function.”

“作为一款窃取软件，Volta 相当成熟。它收集数据的范围非常广，”思科 Talos 的安全研究员 Ryan Fetterman 表示。“它将所有这些信息汇总在一起，最终生成一份序列化档案，并发送给几个大语言模型。它要求模型充当情报分析师，对受害者进行基于引用的结构化评估。这就像是一种优先级排序和分析功能。”

Talos flagged the malware using its new CAIRN framework, built to identify hacking tools that incorporate AI capabilities. Fetterman notes that Talos did not track whether Volta has been used in the wild.

Talos 使用其新的 CAIRN 框架标记了该恶意软件，该框架旨在识别集成人工智能功能的黑客工具。Fetterman 指出，Talos 并未追踪 Volta 是否已在现实环境中被使用。

Volta’s traditional infostealer capabilities are powerful and seem to be geared toward targeting younger internet users with robust digital lives. It sweeps for passwords stored in browsers, Microsoft OAuth tokens, cookies, payment cards, and crypto wallet seed phrases, but also active Discord, Telegram, Steam, and Roblox sessions. Then the malware does a second, deeper sweep using its first-round findings. By looking through the target’s Gmail or another central account, Volta builds a fuller picture of the victim, their location, and their habits using data like receipts and order history from services including UberEats and DoorDash.

Volta 的传统信息窃取功能非常强大，似乎旨在针对数字生活丰富的年轻互联网用户。它会扫描浏览器中存储的密码、Microsoft OAuth 令牌、Cookie、支付卡和加密钱包助记词，以及活跃的 Discord、Telegram、Steam 和 Roblox 会话。随后，该恶意软件会利用第一轮的发现进行第二次更深入的扫描。通过查看目标的 Gmail 或其他核心账户，Volta 利用来自 UberEats 和 DoorDash 等服务的收据和订单历史记录等数据，构建出受害者及其位置和习惯的完整画像。

Once all of this is done, the malware feeds its findings into AI tools for analysis using OpenRouter, a service that can send prompts to multiple different AI providers. Volta defaults its requests to Anthropic’s Claude Opus 4.6. But apparently preparing for the possibility that the model’s guardrails could block the activity, Volta is built with fallbacks to the Chinese open weight Moonshot AI Kimi K2 and, if that fails, Google’s Gemini 2.5 Flash. Building in fallbacks and relying on cost-effective, older-generation models are common techniques among attackers.

完成这一切后，该恶意软件会通过 OpenRouter（一项可向多个不同 AI 提供商发送提示词的服务）将调查结果输入 AI 工具进行分析。Volta 默认向 Anthropic 的 Claude Opus 4.6 发送请求。但显然为了应对模型护栏可能拦截该活动的情况，Volta 内置了备用方案，即中国的开源权重模型月之暗面（Moonshot AI）Kimi K2，如果失败，则会转向 Google 的 Gemini 2.5 Flash。构建备用方案并依赖具有成本效益的旧一代模型是攻击者常用的技术。

Volta’s creators included a 240-word prompt, including bullet points and a numbered list, as part of their instructions to any LLM analyzing the collected data. “You are a forensic intelligence analyst drafting a target assessment from a structured evidence bundle,” the Volta prompt says. It instructs the chatbot to produce an “executive summary” about the person, details of what they do, “what they’re worth,” and a summary of “their opsec.” It adds that the chatbot should “connect dots across fields,” for example, checking whether someone’s Wi-Fi password matches their last name. “Go deep, not wide,” the prompt says.

Volta 的创建者包含了一段 240 字的提示词，其中包括项目符号和编号列表，作为对任何分析所收集数据的大语言模型的指令。“你是一名法医情报分析师，正在根据结构化证据包起草目标评估，”Volta 的提示词写道。它指示聊天机器人生成关于该人的“执行摘要”、其行为细节、“价值几何”以及“操作安全（opsec）”总结。它还要求聊天机器人“跨领域关联信息”，例如检查某人的 Wi-Fi 密码是否与其姓氏匹配。“深入挖掘，不要泛泛而谈，”提示词写道。

“The prompt is pretty carefully crafted not to imply anything overtly malicious,” Fetterman says. “But they’re building in the expectation to potentially hit model refusals at first request. And so they plan for failover kind of cascading to more permissible models as they go down the chain. And there’s also the capability to still use the implant without the AI. The AI calls are kind of above and beyond, but the malware will still work without it.”

“该提示词经过精心设计，没有暗示任何明显的恶意行为，”Fetterman 说。“但他们预料到首次请求可能会遭到模型拒绝。因此，他们计划在链条中向下级联，切换到限制较少的模型作为故障转移。此外，即使没有 AI，该植入程序依然可以使用。AI 调用属于锦上添花，但恶意软件即便没有它也能正常工作。”

Some low-level cybercriminals and scammers have complained about AI slop filling up cybercrime forums, but security researchers are increasingly discovering other hackers using LLMs for coding tasks or analyzing troves of stolen information. Researchers at threat intelligence firm Crowdstrike, for example, recently told WIRED they had seen four distinct hacking groups with varying sophistication—operating in Chinese, Spanish and English, Indonesian, and Russian—using AI tools to compromise dozens of targets around the world, including government entities and businesses in health care, retail, and travel.

一些低级网络罪犯和诈骗者抱怨人工智能生成的垃圾内容充斥着网络犯罪论坛，但安全研究人员越来越多地发现其他黑客正在利用大语言模型进行编码任务或分析海量被盗信息。例如，威胁情报公司 Crowdstrike 的研究人员最近告诉《连线》（WIRED），他们观察到四个不同复杂程度的黑客组织——分别使用中文、西班牙语和英语、印尼语以及俄语——正在利用 AI 工具攻击全球数十个目标，包括政府实体以及医疗保健、零售和旅游行业的企业。

Cisco’s Fetterman says Volta contains some clues that it may have been built to sell to a range of attackers rather than being developed for one specific actor’s campaigns. And while the malware at its core is still a traditional infostealer, the AI expansion foreshadows even more invasive and sinister activity in the future.

思科的 Fetterman 表示，Volta 包含的一些线索表明，它可能是为了出售给各类攻击者而构建的，而非针对某个特定行为者的行动而开发。虽然该恶意软件的核心仍然是传统的信息窃取程序，但 AI 的扩展预示着未来将出现更具侵入性和险恶的活动。

“If you’re able to identify your high-value targets faster, you probably have a better chance of using their credentials or authenticating using stolen tokens more often than maybe you would have if you had to do that triage yourself,” Fetterman says, referencing the fact that authentication tokens expire and passwords can be changed. “We’re seeing more advanced capabilities accessible to lower-level sophistication attackers. It’s really interesting and disturbing.”

“如果你能更快地识别出高价值目标，那么你利用其凭据或使用被盗令牌进行身份验证的机会，可能比你自己进行分类筛选时要大得多，”Fetterman 说道，并提到了身份验证令牌会过期且密码可以更改的事实。“我们看到低水平的攻击者也能获得更先进的能力。这确实既有趣又令人不安。”