Cybercriminals are finding new ways to misuse artificial intelligence, and cybersecurity researchers have identified a concerning development involving an AI-enhanced malware known as Volta-Autodoxer. The malware combines traditional information-stealing techniques with artificial intelligence to collect personal information, analyse victims' digital activities and identify potentially valuable targets.

The discovery was reported on November 2, 2026, following research by Cisco Talos, Cisco's threat intelligence team. The findings highlight how commercially available AI models can be misused to make existing cyberattacks more sophisticated and efficient.

What is Volta-Autodoxer malware?

Volta-Autodoxer is an AI-enhanced form of information-stealing malware, commonly known as an infostealer.

Infostealers are malicious programmes designed to secretly collect sensitive information from infected computers. This can include saved passwords, browser cookies, authentication tokens, payment information and cryptocurrency wallet details.

What makes this particular malware concerning is its ability to send the collected information to AI models for further analysis.

Instead of simply stealing information, it can use artificial intelligence to organise the data and create a detailed profile of the targeted individual.

How does the malware use artificial intelligence?

According to researchers, Volta collects information from several sources on an infected device and compiles it into a structured dossier.

The collected information is then sent to large language models for analysis through an AI model gateway.

The malware reportedly uses models including Anthropic's Claude, Moonshot AI's Kimi and Google's Gemini.

The AI system is instructed to analyse the information like an intelligence analyst. It can connect details from different accounts and activities to build a picture of the victim's digital identity.

For example, information from email accounts, social media activity and online shopping history could potentially reveal a person's interests, habits and other personal details.

Researchers noted that this automated analysis can help attackers identify high-value targets much faster than manual investigation.

Which information can hackers steal?

The malware has reportedly been designed to collect several categories of sensitive information, including:

• Saved usernames and passwords from internet browsers.

• Authentication tokens and browser cookies.

• Payment card information.

• Cryptocurrency wallet recovery phrases.

• Microsoft OAuth tokens.

• Active sessions from platforms such as Discord, Telegram, Steam and Roblox.

The information collected can potentially allow attackers to access online accounts without necessarily needing to know the victim's password in every situation.

Stolen authentication tokens and cookies can be particularly dangerous because they may allow attackers to bypass some conventional login checks.

Why does AI make this malware more dangerous?

Traditional infostealers already pose a significant cybersecurity threat. However, analysing large quantities of stolen information manually requires time and technical expertise.

AI changes this process by helping attackers organise information, identify connections and prioritise potential targets automatically.

This could make sophisticated cybercrime techniques accessible to individuals with comparatively limited technical skills.

Researchers have also highlighted that the malware's use of multiple AI models demonstrates how attackers may attempt to continue their analysis even when one service does not respond as expected.

However, researchers have not established whether Volta-Autodoxer has already been deployed in real-world attacks.

How can you protect your personal information?

Although users cannot completely eliminate cybersecurity risks, following basic digital safety practices can significantly reduce their exposure.

1. Avoid downloading cracked software: Unofficial applications, pirated software and suspicious installers can contain hidden malware.

2. Use a password manager: Avoid storing sensitive passwords in unsecured documents or sharing them across multiple accounts.

3. Enable two-factor authentication: Add an additional verification step to important accounts, especially email, banking and social media accounts.

4. Keep your devices updated: Install operating system, browser and security updates regularly to address known vulnerabilities.

5. Review active login sessions: Check which devices are connected to your Google, Microsoft, social media and other important accounts. Remove unfamiliar sessions.

6. Be careful with suspicious attachments: Avoid opening unexpected files or clicking unknown download links, even when they appear to come from familiar contacts.

7. Use reliable security software: Keep device protection enabled and run regular security scans.

What should you do if you suspect your computer is infected?

If you notice suspicious account activity or believe that malware has been installed on your computer, take action immediately.

Disconnect the affected device from the internet, use a trusted device to change important passwords and revoke unfamiliar active sessions. Contact your bank if payment information may have been exposed.

For potentially compromised work devices, inform your organisation's IT or cybersecurity team rather than attempting to investigate the infection yourself.

The growing connection between AI and cybercrime

The discovery of Volta-Autodoxer highlights an important change in the cybersecurity landscape. Artificial intelligence is helping businesses automate tasks and improve productivity, but the same technology can also be misused by cybercriminals.

The biggest concern is not simply that hackers can steal information, but that AI can help them understand the information, identify valuable targets and organise their next steps.

As AI-powered threats continue to evolve, protecting passwords, authentication tokens and personal information will become increasingly important for everyday internet users.