Researchers have identified a novel malware strain that employs artificial intelligence to enhance its data-stealing capabilities. Dubbed Volta-Autodoxer, this malware collects a wide array of personal information from infected computers and then utilizes large language models (LLMs) to analyze and prioritize the stolen data. The findings were detailed in an analysis published by Cisco Talos on October 31, 2026.

Volta-Autodoxer operates by first gathering extensive data, including browser credentials, cryptocurrency wallet seed phrases, account tokens, and session information from applications like Discord and Steam. It further enriches this data by accessing personal details found in sources such as Gmail receipts and food delivery histories. This collected information is compiled into a dossier.

The distinctive feature of Volta-Autodoxer is its optional AI-driven analysis stage. The malware sends the compiled dossier to an LLM through a service called OpenRouter. The prompt instructs the AI to act as a forensic intelligence analyst, assessing the victim's valuable assets and security vulnerabilities, and to provide evidence-backed conclusions. This allows attackers to quickly identify targets with the highest potential for monetization. The malware is configured to default to Claude Opus 4.6, with fallback options to other models like Kimi K2 and Gemini 2.5 Flash if the primary model refuses the request.

Cisco Talos researchers emphasized that their analysis describes the malware's design and capabilities, and they have not yet tracked confirmed instances of Volta-Autodoxer being used in the wild. The AI component is optional, and the malware can function as a standard infostealer without it. The self-deleting nature of the malware and the absence of dedicated attacker infrastructure further complicate tracking its deployment.

The development of Volta-Autodoxer signifies a trend where cybercriminals are integrating advanced AI tools to refine their operations. By automating the analysis and prioritization of stolen data, attackers can more efficiently exploit victims and maximize their gains. Security experts advise focusing on fundamental security practices, such as preventing credential theft and responding promptly to suspected compromises, as the primary defense against such evolving threats.