Cybercriminals have introduced malware known as stealers equipped with automated AI profiling capabilities. Bi.Zone experts identified two such malicious tools on dark web platforms in September 2026. These programs use large language models to analyze stolen data logs and generate detailed victim profiles.
The Bee Stealer, priced at $300, utilizes AI to categorize victims based on their professional activities and interests. For instance, the tool can identify a user as an IT specialist or web developer by scanning their browser history and domain activity. A similar feature is present in the AVENGER stealer designed for macOS.
According to Oleg Skulkin from Bi.Zone, AI profiling allows attackers to prioritize high-value targets, such as individuals with access to corporate systems or significant crypto assets. This automation enables operators to process large volumes of logs efficiently without manual analysis, facilitating the sorting and resale of stolen information.
While these AI-enhanced tools currently appear in isolated cases, their emergence signals a shift in cyberattack tactics. Experts suggest that future developments may include using AI to determine monetization strategies, such as session hijacking or preparing impersonation attacks. Standard security practices, including revoking tokens and monitoring outbound traffic, remain essential for defense.
