New malware uses AI to analyze stolen data, rank victims, and identify the most profitable targets
VOLTA-AUTODOXER steals credentials, crypto wallets, tokens, and personal information before generating AI dossiers
Researchers warn the malware could commoditize AI-powered victim profiling for ransomware and cybercrime operators
Stealing sensitive data from a lot of people is one thing, but determining whether or not that data is worth anything to anyone – that’s an entirely different ball game. Now, it seems cybercriminals found a way to easily profile their victims’ information and they’re using – you guessed it – Artificial Intelligence (AI). Cybersecurity researchers Cisco Talos uncovered a new malware strain through Cognitive Artificial Intelligence Research Network (CAIRN) – an open source cybersecurity research kit built to identify and track AI-powered malware. The strain is called VOLTA-AUTODOXER and its operation is split into four key steps: 1) steal as much information as possible; 2) share it with an AI for assessment; 3) exfiltrate the data to attacker-controlled infrastructure; and 4) remove yourself from the victim’s system. Analyzing the data
Cisco Talos did not say where exactly the malware was found, how many devices it infected, or how it is being disseminated. It said that, on surface level, it looks just like any other infostealer. It grabs browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots. But this is where it splits from the industry standard, by building a structured evidence bundle about the person behind the system. It pulls the device’s geographical location, home address, employer and employer domain, inferred birth year, the last 4 digits of their credit cards, Slack workspaces, document authorship metadata, iPhone backup indicators, and even a live Roblox account valuation…