[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPySv8mfEAya-98Tm3379v7k5alBBMC7aMjQU_3fcGlc":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"68898265-ac2c-4ec8-9fd4-06aff8c13f5d","AI-powered infostealer picks out the most profitable parts of your stolen data","ai-powered-infostealer-picks-out-the-most-profitable-parts-of-your-stolen-data-22e46b","A new Windows infostealer sends the data it steals to an AI model and asks it to rank the victim’s assets by how much money they could bring in, Cisco Talos has found. “There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics,” said Ryan Fetterman, a security researcher at Cisco. The malware calls itself VOLTA-AUTODOXER and turned up through Talos’ CAIRN … More → The post AI-powered infostealer picks out the most profitable parts of your stolen data appeared first on Help Net Security.","Cisco Talos discovered VOLTA-AUTODOXER, a Windows infostealer that steals credentials, financial data, and personal information, then sends the data to AI models (Claude Opus, Kimi K2, Gemini) via OpenRouter API to rank victims' assets by profitability. The malware employs a builder model sold to buyers who can customize and deploy it via Telegram. VOLTA represents a new cybercrime trend: mass data theft followed by AI-driven prioritization to identify the most lucrative targets.","VOLTA-AUTODOXER infostealer uses AI to rank stolen data by monetary value for attackers.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F02\u002Fai-powered-infostealer-volta-victim-profiling\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002F18171505\u002Fdigital-code.webp","2026-11-02T14:47:57+00:00","2026-11-02T15:00:12.396539+00:00",9,[17,20,23,26,29,31],{"name":18,"type":19},"VOLTA-AUTODOXER operator","threat_actor",{"name":21,"type":22},"Cisco","vendor",{"name":24,"type":25},"OpenRouter API","technology",{"name":27,"type":28},"Claude Opus 4.6","product",{"name":30,"type":28},"Kimi K2",{"name":32,"type":28},"Gemini 2.5 Flash","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,44],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53],{"type":37,"value":51,"context":52},"VOLTA-AUTODOXER","Windows infostealer with AI-driven target ranking, exfiltrates via OpenRouter API",{"type":37,"value":54,"context":55},"CLOSEDQUORUM","Related implant applying similar AI-assisted analysis approach",[21,27,30],{"controls":58,"vendors":141},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":89,"name":90,"problem":91,"products":92},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":43,"name":118,"problem":119,"products":120},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[121,128,133],{"vendor_slug":122,"vendor_name":21,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":129,"product_name":130,"url":131,"description":132},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",[142],{"slug":122,"name":21,"logo_path":123,"roles":143},[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"ai-powered-infostealer-ranks-stolen-data-by-profitability","AI-Powered Infostealer Ranks Stolen Data by Profitability","VOLTA-AUTODOXER represents a dangerous evolution in cybercrime: not only does it steal credentials, financial data, and personal information from Windows systems, but it then uses AI models to automatically prioritize victims by how lucrative they are — dramatically accelerating attacker triage. The builder-and-Telegram distribution model lowers the barrier to entry for criminals, meaning even low-skill threat actors can deploy sophisticated, targeted campaigns. This matters because traditional defenses focused on preventing bulk data theft may be insufficient when AI can instantly surface the highest-value targets from millions of stolen records. Organizations whose employees store sensitive financial or credential data on endpoints are especially at risk, and the speed of AI-driven prioritization shrinks the window defenders have to respond before damage escalates.",[150,151,152,153,154,155,156],"CIS Control 3: Data Protection","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","GDPR Article 32","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"GDPR Article 32":158,"NIS2 Article 21(2)(b)":159,"MITRE ATT&CK T1566: Phishing":160,"CIS Control 3: Data Protection":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"CIS Control 14: Security Awareness and Skills Training":163,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":164},"VOLTA exfiltrates personal and financial data of individuals; Article 32 requires organizations to implement appropriate technical measures to protect personal data, including controls that would limit what data is accessible on endpoints.","NIS2 requires incident handling and monitoring capabilities; detecting anomalous outbound API calls to AI services and bulk data exfiltration are exactly the monitoring controls that would identify a VOLTA infection in progress.","Infostealer campaigns commonly use phishing as the delivery mechanism, and VOLTA's Telegram-based distribution model relies on operators tricking users into executing the payload.","VOLTA harvests credentials and financial data left exposed on endpoints; CIS Control 3 requires organizations to inventory, classify, and protect sensitive data at rest, which would have reduced the value and accessibility of stolen information.","Keeping endpoint software and browsers patched removes known vulnerabilities that infostealers exploit to gain execution and persistence on Windows systems.","Infostealers like VOLTA are typically delivered via phishing or malicious downloads; trained users who recognize social engineering are a critical first line of defense against the initial infection vector.","Enforcing MFA and privileged access controls means that even credentials successfully stolen by VOLTA cannot be immediately used to compromise accounts and escalate the attack."]