Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims
Cisco Talos researchers have identified Volta-Autodoxer, an infostealer that sends information gathered from infected devices to large language models for analysis. The AI is prompted to profile victims, assess their likely value and organise evidence, helping attackers prioritise targets; Talos says it has not tracked whether the malware has been used in the wild.
Volta can collect browser passwords, authentication tokens, cookies, payment card details, crypto wallet seed phrases and active sessions from services including Discord, Telegram, Steam and Roblox. It then searches central accounts such as Gmail for further clues, including location and habits, before sending a dossier through OpenRouter, which can route requests to several AI providers. The malware defaults to Claude Opus 4.6, with Kimi K2 and Gemini 2.5 Flash as fallbacks, and can still operate without AI analysis.
In short
- Volta uses AI to analyse data stolen from infected devices.
- It builds victim profiles from accounts, purchases and online sessions.
- Talos has not established whether it has been used in the wild.
Explained simply
Infostealer malware is designed to steal information from a device, often by taking saved passwords, browser data or login sessions. Attackers can use these details to enter accounts, impersonate their owners or seek access to other services.
Volta-Autodoxer is reported to gather data from browsers and services such as Gmail, Discord and Telegram, then send it to an online service that can connect to different AI models. The AI is asked to organise the material and estimate which victims may be valuable to attackers; the malware can also work without this analysis.
The researchers who described it say they have not established whether it has been used in real attacks. The report matters because it shows one way AI could help attackers sort stolen personal information, while the underlying theft still depends on malware reaching a device.