Hackers Are Using Claude, Gemini And Kimi AI To Profile Victims: New Volta-Autodoxer Malware Raises Security Concerns
Last Updated: 2026-11-02 16:44:38
Cybersecurity researchers have uncovered a new type of information-stealing malware that uses commercial artificial intelligence models to analyse stolen personal data and build detailed profiles of potential victims.
The malware, identified as Volta-Autodoxer, demonstrates how hackers could use mainstream AI tools to make traditional cybercrime operations more sophisticated. Instead of simply stealing passwords and financial information, the malware can feed collected data into AI models to identify valuable targets and extract additional insights about them.
Latest and Popular Mobiles
The discovery was reported by researchers at Cisco’s Talos threat intelligence unit, which identified the malware using its CAIRN framework for detecting hacking tools incorporating AI capabilities.
According to the research, Volta-Autodoxer can collect information from several sources associated with a victim. This includes browser-stored login credentials, payment card details, cryptocurrency wallet information, authentication tokens and data linked to online accounts.
Related Articles
The malware can also gather information associated with services such as Gmail, social media platforms, Discord, Telegram, Steam and Roblox.
One particularly concerning aspect is its ability to use information from online shopping and food delivery accounts. Such records could reveal details about a person’s location, spending habits, interests and daily routines.
After collecting the information, the malware sends it to artificial intelligence models for analysis through OpenRouter, a platform that provides access to multiple AI services.
The system reportedly uses Anthropic’s Claude Opus 4.6 as its default model. If that model does not process the request, it can switch to Moonshot AI’s Kimi K2. Google’s Gemini 2.5 Flash is listed as another fallback option.
The malware uses a specially prepared prompt instructing the AI model to behave like a forensic intelligence analyst. It asks the model to generate an assessment of the victim using the collected information, including details about their activities, financial worth and security practices.
The instructions also encourage the AI system to connect information from different sources to identify possible relationships and vulnerabilities.
This makes the malware particularly concerning because information that might appear harmless when examined individually could become more valuable when combined. For example, shopping histories, social media activity and account details could collectively provide insights into a person’s lifestyle and behaviour.
The researchers’ findings highlight how AI can potentially reduce the amount of manual analysis required by cybercriminals. Rather than examining large volumes of stolen information themselves, attackers could use AI models to organise the data and identify promising targets.
However, researchers have not established whether Volta-Autodoxer has already been deployed in real-world attacks.
For users, the discovery is another reminder of the importance of securing online accounts. Reusing passwords, storing sensitive information carelessly and granting unnecessary permissions to applications can increase the risks associated with information-stealing malware.
Using unique passwords, enabling multi-factor authentication, reviewing account sessions and avoiding suspicious downloads remain important security measures.