AI now compiles dossiers on users of compromised devices

AI now compiles dossiers on users of compromised devices

Infostealers featuring built‑in AI‑powered victim profiling have emerged on underground marketplaces. Our researchers identified two such stealers in September alone
October 16, 2026

Standard infostealers harvest passwords, active session cookies, banking card and cryptocurrency wallet information, and other device and user details. We have uncovered a new generation of infostealers designed to extract chat histories and authentication data from AI assistants. This includes source code, internal documents, tokens, and account information.

Instead of simply handing a raw data dump to the attacker, the LLM generates a concise profile of the device owner, including their likely profession, interests, frequently visited resources, and other characteristics inferred from the log—the stolen dataset.

For example, Bee Stealer, priced at $300, processes a portion of the stolen information, using AI on the threat actor’s side. According to the malware’s author, the AI flagged one victim as an IT specialist and web developer with an interest in cybersecurity, highlighting domains related to their activities. The AVENGER infostealer for macOS boasts a similar feature, analyzing browser history, command‑line history, messages, email, and configuration files, then uses all this information to build a victim profile.

For an attacker receiving logs from multiple compromised devices, AI quickly highlights the most valuable targets. An LLM can flag a developer with access to corporate systems or a user holding high‑value crypto assets. Instead of sorting through raw data, attackers receive a turnkey victim profile ready for filtering and resale—eliminating the need to deeply analyze each individual log.
Oleg Skulkin
Head of BI.ZONE Threat Intelligence

While these currently represent isolated cases, the rapid appearance of several such listings signal that AI is becoming a standard tool for threat actors.

Looking ahead, threat actors may leverage LLMs not only to profile victims but also to automate stolen data monetization. For example, the models can help identify valuable sessions, restore access using harvested tokens, or orchestrate impersonation attacks. Meanwhile, basic defenses against infostealers remain unchanged: if a compromise is suspected, organizations must terminate active sessions, revoke tokens, and reset credentials. Because AI‑driven analysis happens post‑exfiltration, organizations should prioritize outbound traffic monitoring.

The BI.ZONE Threat Intelligence portal provides timely access to the latest indicators of compromise, alongside detailed data on threat actor tactics and toolkits. This intelligence empowers security teams to respond to incidents faster and build robust defenses tailored to the most likely threats facing their organization.

#attacks
#ai
#underground