Most infostealers work like a smash-and-grab. They empty the browser's password store, lift session cookies and payment cards, and ship the lot to a server. A newly documented strain does one more thing before it closes the connection: it asks a language model to write a report about the person it just robbed.
The malware is called Volta-Autodoxer, after the string it uses to refer to itself internally. Researchers at Cisco Talos shared it exclusively with WIRED's Kernel Panic newsletter. The stealer underneath it, Volta, is mature rather than novel: it sweeps browser passwords, Microsoft OAuth tokens, cookies, payment cards and crypto wallet seed phrases, and it also walks off with live Discord, Telegram, Steam and Roblox sessions. It appears aimed at younger users with dense digital lives.
Then comes a second pass. Using what it already has, it opens a central account — Gmail is the example given — and reads receipts and order history from services such as UberEats and DoorDash to build a picture of where the victim lives, what they buy and how they spend their days.
All of that is compiled into a serialised dossier and sent through OpenRouter, a routing service that can forward a single prompt to several model providers. Volta defaults to Anthropic's Claude Opus 4.6. Anticipating that a model may refuse, its operators built a fallback chain: Moonshot AI's open-weight Kimi K2 first, then Google's Gemini 2.5 Flash.
The attached prompt runs to 240 words and is framed as ordinary analytics work. "You are a forensic intelligence analyst drafting a target assessment from a structured evidence bundle," it begins. It asks for an executive summary of the person, what they do, "what they're worth", and a summary of "their opsec" — then instructs the model to "connect dots across fields", for instance by checking whether someone's Wi-Fi password matches their last name. "Go deep, not wide," it says.
"It's asking the model to act like an intelligence analyst and produce structured citation-backed assessment of the victim," Ryan Fetterman, a security researcher at Cisco Talos, told WIRED. "It's like a prioritization and analysis function."
That prioritisation is the whole point. Stolen session tokens expire and passwords get rotated, so the value of a breach decays by the hour. A ranked shortlist of which of thousands of infected machines belongs to someone with money, a corporate account and sloppy habits is worth far more than an unsorted pile of credentials.
Two caveats matter. Talos did not track whether Volta-Autodoxer has been used in the wild, and the AI stage is optional — strip out the model calls and the stealer still runs. "The AI calls are kind of above and beyond, but the malware will still work without it," Fetterman said. He also sees signs the code was built for sale to a range of criminal customers rather than for one actor's campaign.
Talos surfaced the sample with CAIRN, an open-source toolkit it released in September for hunting and classifying malware that carries AI-integration artefacts. That tool exists because the pattern is spreading: CrowdStrike researchers told WIRED they had seen four distinct groups, working in Chinese, Spanish and English, Indonesian and Russian, using AI tools against dozens of targets including government bodies and firms in health care, retail and travel.
What is new here is not that criminals use chatbots to write code. It is that the malware itself calls one, at scale, on data it has already stolen, and plans for the model saying no.
What is not known: how Volta-Autodoxer is distributed — its predecessors typically travel inside counterfeit installers — how many machines have run it, and whether the LLM stage measurably improves the attackers' hit rate. Talos's evidence is the sample and its prompt, not a body count.
