12

GLOBAL CYBERSECURITY — October 31, 2026. Cybersecurity researchers have uncovered a sophisticated information-stealing malware program capable of collecting passwords, financial credentials and private communications before using commercial artificial intelligence models to construct detailed profiles of its victims. Identified as VOLTA-AUTODOXER, the malicious software represents an emerging development in cybercrime, where generative AI is no longer used exclusively to create malicious tools but increasingly to analyze stolen information and help attackers identify potentially valuable targets.

The discovery was made by Cisco Talos, the cybersecurity research division of Cisco, and disclosed on October 31. Researcher Ryan Fetterman identified the malware through the organization’s CAIRN framework, designed to detect malicious software incorporating artificial intelligence capabilities. The investigation reveals how traditional information theft can be combined with automated analysis to transform fragmented personal data into structured intelligence.

Unlike conventional malware that primarily extracts files and credentials, VOLTA-AUTODOXER introduces an additional analytical stage. After collecting sensitive information from an infected Windows computer, the software organizes the material and submits it to large language models, or LLMs, which are instructed to evaluate the victim’s digital identity, financial assets, security practices and potential value to cybercriminals.

The distinction is significant. Traditional information stealers, commonly known as infostealers, already represent a major cybersecurity threat because they can compromise passwords, authentication tokens, banking information and access to online services. The incorporation of AI does not necessarily improve the initial intrusion, but it can reduce the time and expertise required to interpret large quantities of stolen information.

New AI-Powered Malware Steals Passwords and Builds Detailed Intelligence Profiles of Its Victims

GLOBAL CYBERSECURITY — October 31, 2026. Cybersecurity researchers have uncovered a sophisticated information-stealing malware program capable of collecting passwords, financial credentials and private communications before using commercial artificial intelligence models to construct detailed profiles of its victims. Identified as VOLTA-AUTODOXER, the malicious software represents an emerging development in cybercrime, where generative AI is no longer used exclusively to create malicious tools but increasingly to analyze stolen information and help attackers identify potentially valuable targets.

The discovery was made by Cisco Talos, the cybersecurity research division of Cisco, and disclosed on October 31. Researcher Ryan Fetterman identified the malware through the organization’s CAIRN framework, designed to detect malicious software incorporating artificial intelligence capabilities. The investigation reveals how traditional information theft can be combined with automated analysis to transform fragmented personal data into structured intelligence.

Unlike conventional malware that primarily extracts files and credentials, VOLTA-AUTODOXER introduces an additional analytical stage. After collecting sensitive information from an infected Windows computer, the software organizes the material and submits it to large language models, or LLMs, which are instructed to evaluate the victim’s digital identity, financial assets, security practices and potential value to cybercriminals.

The distinction is significant. Traditional information stealers, commonly known as infostealers, already represent a major cybersecurity threat because they can compromise passwords, authentication tokens, banking information and access to online services. The incorporation of AI does not necessarily improve the initial intrusion, but it can reduce the time and expertise required to interpret large quantities of stolen information.

VOLTA-AUTODOXER begins by searching infected computers for credentials stored in web browsers, session cookies, payment card details and cryptocurrency wallet recovery phrases. It also targets authentication information associated with Microsoft services, remote servers, Wi-Fi networks and other systems that may provide access to additional resources.

Its collection capabilities extend to gaming and communication platforms, including Discord, Telegram, Steam and Roblox. By extracting active session information, attackers may obtain access to accounts without necessarily needing to enter the original passwords, depending on the security measures implemented by each service.

The malware subsequently conducts a second stage of information gathering. Using previously obtained credentials or session access, it attempts to inspect email accounts and online services for information that can reveal the victim’s identity, location and personal habits.

Researchers identified functions capable of examining Gmail messages for purchase receipts from platforms such as Amazon, Walmart and PayPal, alongside delivery histories from Uber Eats, DoorDash and Grubhub. Such information can help establish residential addresses, spending patterns and commercial activities.

This process transforms information that may appear relatively insignificant when examined separately into a comprehensive personal profile. A food delivery receipt can indicate a physical address, while purchase records may reveal financial habits, household characteristics or recurring activities.

The software consolidates the collected information into a file named Identity_Report.txt, containing details such as geographic location, employer, estimated year of birth and partial payment card information.

The resulting dossier is then transmitted for AI-assisted analysis through OpenRouter, a service that provides access to different artificial intelligence models through a common interface.

According to the investigation, the malware is configured to consult Anthropic’s Claude Opus 4.6 initially. If the response is rejected or another problem occurs, the program can attempt to use Moonshot AI’s Kimi K2 and subsequently Google’s Gemini 2.5 Flash.ngly embedded within business applications, development environments and personal workflows, creating additional information assets that require protection.

For organizations, the implications are substantial. A compromised employee computer may contain access to corporate email, cloud services, development platforms and internal communication channels. Information gathered from those systems could expose business relationships, operational structures or credentials that enable further unauthorized access.

The increasing use of cloud-based authentication and persistent sessions also changes the nature of identity-related threats. Protecting a password is no longer sufficient when attackers can potentially obtain valid session tokens or authentication artifacts from compromised devices.

Effective cybersecurity therefore requires attention to device security, access management and the ability to detect abnormal behavior after authentication has occurred.

Measures such as multifactor authentication remain important, but their effectiveness depends on the type of attack. Some forms of session theft can bypass the need for repeated authentication, making session revocation, device monitoring and phishing-resistant authentication methods valuable components of a broader security strategy.

For individual users, the investigation reinforces the importance of obtaining software from legitimate sources, maintaining updated operating systems and using reputable security tools. Counterfeit applications and deceptive downloads remain common distribution mechanisms for information-stealing malware.

Unique passwords stored through a trusted password manager can help limit the consequences of credential exposure, while additional authentication controls may reduce the risk associated with stolen passwords.

If an infection is suspected, changing passwords alone may not be sufficient. Potentially compromised sessions should also be revoked, affected devices should undergo appropriate security assessment, and sensitive credentials should be replaced from a trusted environment.

Users whose cryptocurrency wallet recovery phrases have been exposed may need to consider the wallet compromised, because possession of a valid recovery phrase can enable unauthorized control over its assets.

The broader privacy implications extend beyond financial losses. Access to email histories, purchases and online activity can expose personal relationships, residential information and daily routines. When combined through automated analysis, these details may become useful for targeted fraud, impersonation or social engineering.

That possibility illustrates why cybersecurity is increasingly connected to personal data governance. Organizations and individuals routinely distribute information across numThe central challenge is no longer limited to preventing a computer from surrendering passwords. It also involves protecting the broader digital identity that can be reconstructed when authentication data, financial records, communications and everyday online activities are exposed together.

For cybersecurity professionals, the discovery offers a warning about the potential evolution of information-stealing malware. For technology companies, it highlights the need to strengthen safeguards around the misuse of automated analytical services. For users, it reinforces the importance of treating personal data protection as an integrated security responsibility rather than a collection of isolated account settings.

The unresolved question is how rapidly cybercriminals may adopt AI-assisted profiling capabilities and whether defensive technologies, institutional safeguards and digital security practices can evolve sufficiently to prevent stolen data from being transformed into increasingly detailed intelligence about the people behind it.

Phoenix24: Beyond the technology, the transformation. / Más allá de la tecnología, la transformación.

VOLTA-AUTODOXER begins by searching infected computers for credentials stored in web browsers, session cookies, payment card details and cryptocurrency wallet recovery phrases. It also targets authentication information associated with Microsoft services, remote servers, Wi-Fi networks and other systems that may provide access to additional resources.

Its collection capabilities extend to gaming and communication platforms, including Discord, Telegram, Steam and Roblox. By extracting active session information, attackers may obtain access to accounts without necessarily needing to enter the original passwords, depending on the security measures implemented by each service.

The malware subsequently conducts a second stage of information gathering. Using previously obtained credentials or session access, it attempts to inspect email accounts and online services for information that can reveal the victim’s identity, location and personal habits.

The resulting dossier is then transmitted for AI-assisted analysis through OpenRouter, a service that provides access to different artificial intelligence models through a common interface.

According to the ciently to prevent stolen data from being transformed into increasingly detailed intelligence about the people behind it.

Phoenix24: Beyond the technology, the transformation. / Más allá de la tecnología, la transformación.