Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims

THE NEWS

What happened

New research reveals a sophisticated infostealer malware strain called 'Volta-Autodoxer' that integrates artificial intelligence to automatically profile victims. Developed by threat actors, this malware uses large language models (LLMs) like Anthropic's Claude and Google's Gemini to analyze stolen data, identify high-value targets, and generate detailed dossiers on individuals' habits and digital footprints. This development marks a significant escalation in cybercrime capabilities, allowing lower-sophistication attackers to perform advanced intelligence analysis previously reserved for state-sponsored groups.

CONTEXT

Why it matters

New research from Cisco Talos reveals a dangerous new strain of malware dubbed 'Volta-Autodoxer.' Unlike traditional infostealers that simply steal data, this version uses AI models like Anthropic's Claude and Google's Gemini to automatically analyze victims. It builds detailed profiles on habits, location, and financial value by cross-referencing stolen credentials with order history and social media activity. This technology allows lower-level cybercriminals to perform advanced intelligence analysis previously reserved for sophisticated groups, significantly increasing the risk of targeted attacks against individuals and businesses.

AT A GLANCE

Key facts

• The malware is internally named 'Volta-Autodoxer' and was identified by Cisco Talos researchers.
• It automatically collects usernames, passwords, tokens, cookies, credit card data, and crypto wallet seed phrases.
• The malware feeds stolen data into AI models via OpenRouter to generate structured intelligence assessments of victims.
• Default AI model is Anthropic's Claude Opus 4.6, with fallbacks to Moonshot AI Kimi K2 and Google's Gemini 2.5 Flash.
• The AI prompt instructs the model to act as a forensic analyst to determine 'what they're worth' and connect dots across different data fields.
• Security experts warn this trend lowers the barrier for attackers, making advanced profiling accessible to lower-level cybercriminals.
• The malware retains traditional infostealer functionality even if AI calls are blocked or fail.