New password-stealing malware uses AI to profile its victims
A new strain of infostealer malware uses AI chatbots to profile victims, which makes saved browser passwords and logged-in sessions riskier.
What happened
Wired reports that researchers at Cisco Talos have found a new strain of password-stealing malware that uses AI to sort through what it steals. It is nicknamed "Volta-Autodoxer" because of how the malware refers to itself internally.
This kind of malware is called an infostealer: software that quietly copies logins and other private data off an infected computer. Wired says Volta sweeps up passwords saved in browsers, cookies (small files that keep you logged in), payment cards and more. It then bundles everything into a profile and sends it to AI chatbots, asking them to act like an intelligence analyst and judge what the victim is worth.
One caveat: Wired notes that Talos did not track whether Volta has been used in the wild.
Why it matters
Infostealers are often hidden in counterfeit software, according to Wired. It adds that many of the biggest breaches in recent years, including the Snowflake-linked breaches that hit AT&T and Ticketmaster, started with logins gathered this way. The malware has stolen hundreds of millions of credentials overall.
The AI part is about speed. Wired quotes Cisco Talos researcher Ryan Fetterman as saying that if attackers can identify high-value targets faster, they probably have a better chance of using stolen credentials or tokens before those tokens expire or the password gets changed.
To picture what that could look like, imagine one infected laptop being quickly singled out as the one that opens a company's email, payment tools or customer records. That is an illustration, not something the report describes.
What it means for your business
- Accounting and law firms: Staff often keep client files, email and banking portals open all day. A stolen logged-in session could be as useful to a thief as a password.
- Clinics: If front-desk computers are shared and passwords are saved in the browser, one infection could reach more systems than you'd expect. That is a general caution, not something the report says about clinics.
- Retail and online shops: Payment dashboards and supplier accounts are the kind of logins worth protecting first.
- Agencies: You hold access to many clients' accounts, so one employee's infected device could put all of them at risk.
The habits that help are cheap. Don't install pirated or unvetted software. Don't save passwords in the browser, and use a password manager instead. Turn on multi-factor authentication (a second check, like a code on your phone). If a device seems infected, sign out of everything and reset passwords from a clean device.
One thing to try this week
Make a short list of the accounts that would hurt most if stolen: business email, banking, payment processing and your customer database. Then confirm that multi-factor authentication is switched on for each one, for every person who uses them. Start with your own login.