内容来源：https://www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/

内容总结：

安全研究人员发现，黑客已开始将人工智能功能植入新型信息窃取恶意软件，使系统能够自动对受害者进行画像，并快速筛选出最高价值目标及其信息。思科Talos团队将这一恶意软件命名为“Volta-Autodoxer”，该发现揭示了商业大语言模型正被用于增强既有类型恶意软件的能力。

信息窃取恶意软件通常隐藏在盗版软件中，专门从受感染设备中窃取用户名、密码、认证令牌、Cookie、信用卡数据等信息。近年来多起重大数据泄露事件——包括涉及AT&T和Ticketmaster的Snowflake关联泄露事件，以及迪士尼1TB数据失窃案——均源于黑客利用信息窃取软件获取的登录凭据入侵目标。近年来，此类恶意软件已窃取数亿条凭据。

Talos安全研究员瑞安·费特曼表示，Volta作为窃取工具已相当成熟，收集范围广泛，会将所有信息汇总生成序列化档案，并发送给多个大语言模型，要求模型充当情报分析师，产出有结构化引用支撑的受害者评估报告，实质上承担优先级排序和分析功能。Talos通过其新开发的CAIRN框架标记了该恶意软件，该框架专门用于识别集成AI功能的黑客工具。费特曼指出，Talos尚未追踪Volta是否已在真实环境中被使用。

Volta的传统窃取能力 targeting 拥有丰富数字生活的年轻互联网用户，除扫描浏览器密码、微软OAuth令牌、Cookie、支付卡和加密钱包助记词外，还会窃取Discord、Telegram、Steam和Roblox的活跃会话。随后，恶意软件利用第一轮发现进行更深层扫描，通过查看目标的Gmail或其他核心账户，利用UberEats、DoorDash等服务的收据和订单历史等数据，构建受害者更完整的画像，包括其位置和习惯。

完成上述步骤后，恶意软件将发现结果通过OpenRouter服务送入AI工具分析，该服务可将提示词发送给多个不同AI提供商。Volta默认请求Anthropic的Claude Opus 4.6，但显然为应对模型护栏可能阻止相关活动的情况，内置了回退机制，依次转向中国开源模型Moonshot AI的Kimi K2，若仍失败则使用谷歌的Gemini 2.5 Flash。构建回退机制并依赖高性价比的旧代模型是攻击者的常见手法。

Volta的创建者内置了一段240词的提示词，包含要点和编号列表，作为指示大语言模型分析所收集数据的指令的一部分。提示词要求聊天机器人生成关于该人员的“执行摘要”、其从事工作的详情、“其价值”以及“其Opsec”的总结，并指示应“跨字段串联线索”，例如检查某人的Wi-Fi密码是否与其姓氏匹配。提示词还强调“深入而非宽泛”。

费特曼表示，该提示词经过精心设计，避免 overtly 恶意表述，但构建者预期首次请求可能遭遇模型拒绝，因此规划了向更宽松模型逐级回退的故障转移机制。同时，即使没有AI，植入程序仍可正常使用，AI调用属于额外增强功能。

尽管部分低级网络犯罪份子和诈骗者抱怨AI垃圾内容充斥犯罪论坛，但安全研究人员正日益发现其他黑客利用大语言模型进行编码任务或分析大量窃取信息。威胁情报公司CrowdStrike研究人员近日向《连线》透露，已发现四个技术水平各异的黑客组织——分别以中文、西班牙语和英语、印尼语及俄语运作——利用AI工具入侵全球数十个目标，包括政府机构及医疗、零售和旅游行业企业。

思科费特曼表示，Volta包含一些线索表明其可能面向广泛攻击者出售，而非为某一特定行为者的行动开发。尽管该恶意软件核心仍是传统信息窃取器，但AI扩展预示着未来更具侵入性和恶意的活动。费特曼指出，若能更快识别高价值目标，攻击者就更有可能利用其凭据或 stolen 令牌进行认证，因为认证令牌会过期、密码可被更改。他表示，更低水平的攻击者正获得更高级的能力，这“非常值得关注且令人不安”。

中文翻译：

欢迎来到Kernel Panic，这是Lily Hay Newman和Matt Burgess每周撰写的时事通讯，带你深入了解隐私与数字安全的新世界。若想每周在收件箱中收到本通讯，请在此处订阅。

独家分享给Kernel Panic的最新研究显示，黑客已开始将AI功能植入一种新型信息窃取恶意软件，使系统能够自动对受害者进行画像，并迅速筛选出最高价值目标及其信息。该恶意软件因内部自称“Volta-Autodoxer”而得名。思科Talos研究人员的这一发现揭示了商业大语言模型正被用于增强和提升既有类型恶意软件能力的种种方式。

信息窃取程序通常隐藏于盗版软件中，顾名思义，其设计目的就是从受感染的机器上窃取用户名、密码、身份验证令牌、Cookie、信用卡数据等信息。近年来许多重大数据泄露事件——从涉及AT&T和Ticketmaster的大规模Snowflake关联泄露，到迪士尼一太字节数据被盗——都是黑客利用信息窃取程序收集的登录凭证入侵目标所致。总体而言，近年来该恶意软件已被用于窃取数亿份凭证。

“Volta作为窃取程序已经相当成熟。它的采集范围非常广，”思科Talos安全研究员Ryan Fetterman表示。“它将所有这些信息汇总在一起，最终生成一份序列化的档案，可以发送给多个大语言模型。它要求模型扮演情报分析员的角色，生成有结构化引证支撑的受害者评估报告。这相当于一种优先级排序和分析功能。”

Talos利用其新推出的CAIRN框架标记了该恶意软件，该框架专为识别集成了AI功能的黑客工具而构建。Fetterman指出，Talos并未追踪Volta是否已在真实环境中被使用。

Volta的传统信息窃取功能十分强大，且似乎专门针对数字生活丰富的年轻互联网用户。它会扫描浏览器中存储的密码、微软OAuth令牌、Cookie、支付卡和加密钱包助记词，同时还会检测活跃的Discord、Telegram、Steam和Roblox会话。随后，恶意软件利用第一轮发现的线索进行第二轮更深入的扫描。通过查看目标的Gmail或其他核心账户，Volta利用UberEats和DoorDash等服务中的收据和订单历史等数据，构建出受害者更完整的画像，包括其位置和习惯。

完成上述步骤后，恶意软件将发现结果输入AI工具进行分析，使用的是OpenRouter——一个可将提示词发送给多个不同AI提供商的服务。Volta默认将请求发送给Anthropic的Claude Opus 4.6。但显然为了应对模型护栏可能阻止相关活动的可能性，Volta内置了备选方案，可回退至中国开放权重模型Moonshot AI的Kimi K2，若仍失败则回退至谷歌的Gemini 2.5 Flash。内置备选方案并依赖高性价比的旧代模型是攻击者的常见手法。

Volta的创建者编写了一段240词的提示词，包含要点列表和编号列表，作为指示任何大语言模型分析所收集数据的指令的一部分。“你是一名取证情报分析员，正在根据结构化证据包起草目标评估报告，”Volta的提示词写道。它指示聊天机器人生成关于该人员的“执行摘要”、其所从事活动的详情、“其价值”以及“其操作安全”的概要。它还要求聊天机器人“跨字段串联线索”，例如检查某人的Wi-Fi密码是否与其姓氏匹配。“深入而非广撒网，”提示词写道。

“这段提示词经过精心设计，不会暗示任何明显的恶意意图，”Fetterman说。“但他们预判了首次请求可能触发模型拒绝的情况。因此他们规划了故障转移机制，沿着链条逐级回退到更宽松的模型。此外，即使没有AI，植入程序仍然可以使用。AI调用算是锦上添花，但恶意软件在没有AI的情况下依然能运作。”

一些低级网络犯罪分子和诈骗者抱怨AI垃圾内容充斥网络犯罪论坛，但安全研究人员越来越多地发现其他黑客正在利用大语言模型进行编码任务或分析大量窃取的信息。例如，威胁情报公司CrowdStrike的研究人员近日告诉《连线》杂志，他们已发现四个技术水平各异的黑客组织——分别使用中文、西班牙语和英语、印尼语以及俄语——利用AI工具入侵了全球数十个目标，包括政府机构以及医疗保健、零售和旅游行业的企业。

思科的Fetterman表示，Volta包含一些线索表明它可能是为出售给各类攻击者而构建的，而非为某个特定行为者的行动而开发。尽管该恶意软件的核心仍是传统的信息窃取程序，但AI扩展预示着未来将出现更具侵入性和更为险恶的活动。

“如果你能更快地识别高价值目标，你很可能有更大机会利用他们的凭证或使用窃取的令牌进行身份验证，比你亲自进行筛选时要频繁得多，”Fetterman说，他指的是身份验证令牌会过期、密码可以被更改这一事实。“我们看到更高级的能力正被技术水平较低的攻击者所获取。这非常引人关注，也令人不安。”

评论

返回顶部

英文来源：

Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here.
New research shared exclusively with Kernel Panic shows that hackers have started adding AI functionality into a new strain of infostealer malware, making it possible for the system to automatically profile victims and quickly surface the highest value targets and their information. Dubbed “Volta-Autodoxer” because of how the malware refers to itself internally, the finding by Cisco Talos researchers sheds light on the ways that commercial LLMs are being used to augment and enhance the capabilities of established types of malware.
Often hidden in counterfeit software, infostealers are designed to live up to their name, grabbing usernames, passwords, authentication tokens, cookies, credit card data, and more from infected machines. Many of the biggest data breaches in recent years—from the widespread Snowflake-linked breaches that included AT&T and Ticketmaster to the theft of a terabyte of Disney data—have resulted from hackers accessing targets using login details gathered by infostealers. Overall, the malware has been used to steal hundreds of millions of credentials in recent years.
“Volta is pretty mature as a stealer. It casts a pretty wide net for what it collects,” says Ryan Fetterman, a security researcher at Cisco Talos. “It compiles all of those things together, ultimately producing a serialized dossier that it can send to a couple LLM models. It’s asking the model to act like an intelligence analyst and produce structured citation-backed assessment of the victim. It’s like a prioritization and analysis function.”
Talos flagged the malware using its new CAIRN framework, built to identify hacking tools that incorporate AI capabilities. Fetterman notes that Talos did not track whether Volta has been used in the wild.
Volta’s traditional infostealer capabilities are powerful and seem to be geared toward targeting younger internet users with robust digital lives. It sweeps for passwords stored in browsers, Microsoft OAuth tokens, cookies, payment cards, and crypto wallet seed phrases, but also active Discord, Telegram, Steam, and Roblox sessions. Then the malware does a second, deeper sweep using its first-round findings. By looking through the target’s Gmail or another central account, Volta builds a fuller picture of the victim, their location, and their habits using data like receipts and order history from services including UberEats and DoorDash.
Once all of this is done, the malware feeds its findings into AI tools for analysis using OpenRouter, a service that can send prompts to multiple different AI providers. Volta defaults its requests to Anthropic’s Claude Opus 4.6. But apparently preparing for the possibility that the model’s guardrails could block the activity, Volta is built with fallbacks to the Chinese open weight Moonshot AI Kimi K2 and, if that fails, Google’s Gemini 2.5 Flash. Building in fallbacks and relying on cost-effective, older-generation models are common techniques among attackers.
Volta’s creators included a 240-word prompt, including bullet points and a numbered list, as part of their instructions to any LLM analyzing the collected data. “You are a forensic intelligence analyst drafting a target assessment from a structured evidence bundle,” the Volta prompt says. It instructs the chatbot to produce an “executive summary” about the person, details of what they do, “what they’re worth,” and a summary of “their opsec.” It adds that the chatbot should “connect dots across fields,” for example, checking whether someone’s Wi-Fi password matches their last name. “Go deep, not wide,” the prompt says.
“The prompt is pretty carefully crafted not to imply anything overtly malicious,” Fetterman says. “But they’re building in the expectation to potentially hit model refusals at first request. And so they plan for failover kind of cascading to more permissible models as they go down the chain. And there’s also the capability to still use the implant without the AI. The AI calls are kind of above and beyond, but the malware will still work without it.”
Some low-level cybercriminals and scammers have complained about AI slop filling up cybercrime forums, but security researchers are increasingly discovering other hackers using LLMs for coding tasks or analyzing troves of stolen information. Researchers at threat intelligence firm Crowdstrike, for example, recently told WIRED they had seen four distinct hacking groups with varying sophistication—operating in Chinese, Spanish and English, Indonesian, and Russian—using AI tools to compromise dozens of targets around the world, including government entities and businesses in health care, retail, and travel.
Cisco’s Fetterman says Volta contains some clues that it may have been built to sell to a range of attackers rather than being developed for one specific actor’s campaigns. And while the malware at its core is still a traditional infostealer, the AI expansion foreshadows even more invasive and sinister activity in the future.
“If you’re able to identify your high-value targets faster, you probably have a better chance of using their credentials or authenticating using stolen tokens more often than maybe you would have if you had to do that triage yourself,” Fetterman says, referencing the fact that authentication tokens expire and passwords can be changed. “We’re seeing more advanced capabilities accessible to lower-level sophistication attackers. It’s really interesting and disturbing.”
Comments
Back to top