Hackers Use AI to Find High-Value Targets

Cybercriminals have begun embedding AI functionalities into malware strains, exemplified by the new infostealer dubbed "Volta-Autodoxer." This development allows the malware to automatically profile victims, rapidly identifying high-value targets and their sensitive information. Cisco Talos researchers discovered this innovation, highlighting how commercial large language models (LLMs) are augmenting traditional malware.

Infostealers typically harvest credentials, cookies, and payment data from infected systems. Volta-Autodoxer exhibits enhanced capabilities by sweeping for browser passwords, authentication tokens, and active sessions across platforms like Discord and Telegram. It then utilizes AI to analyze this collected data, building a comprehensive victim profile.

The malware employs a detailed prompt to instruct LLMs to act as forensic intelligence analysts, assessing victim worth and operational security. It includes fallbacks to different AI models, such as Moonshot AI and Google Gemini, to circumvent potential model refusals and reduce costs. Researchers note this AI integration makes advanced capabilities accessible to less sophisticated attackers.

This evolution in malware signifies a concerning trend where AI assists in faster identification and exploitation of high-value targets. The ability to quickly triage victims is crucial, as authentication tokens expire and passwords can be changed, making timely exploitation critical for attackers.