Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims

New research reveals a malicious strain of infostealer malware called "Volta-Autodoxer," which utilizes AI to automatically profile and prioritize victims. Cisco Talos researchers discovered this development, which demonstrates how large language models are being integrated into existing malicious software. Infostealers are typically used to steal sensitive data like usernames, passwords, and credit card information from compromised devices.

These breaches have been responsible for numerous high-profile data breaches, including those involving AT&T, Ticketmaster, and Disney. Volta-Autodoxer is capable of gathering hundreds of millions of credentials, and its traditional functionality includes capturing data from browsers, Microsoft OAuth tokens, cookies, payment cards, and crypto wallet seed phrases.

The malware also performs a deeper scan of the victim's Gmail or other central accounts to gather additional information about their habits, location, and online activities. To process this data, Volta-Autodoxer uses OpenRouter to analyze it through AI models such as Anthropic's Claude Opus 4.6, Moonshot AI Kimi K2, and Google's Gemini 2.5 Flash.

The malware's creators include a specific prompt for the AI to analyze the collected data and generate a structured, citation-backed assessment of the victim, including their occupation, worth, and security practices. The prompt emphasizes the importance of connecting the dots across various fields, such as checking whether a Wi-Fi password matches a victim's last name.

While Volta-Autodoxer is primarily a traditional infostealer, its incorporation of AI capabilities signals a troubling trend of more sophisticated and invasive cyber threats that could be accessible to less sophisticated attackers.