Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims

Cisco Talos has uncovered a new infostealer, Volta‑Autodoxer, that leverages large language models to autonomously profile victims and prioritize credential theft. The malware first harvests tokens, passwords, and personal data from endpoints, then feeds the collected data into an LLM for rapid analysis and prioritization. This allows the attacker to focus on high-value credentials—particularly those used in single sign‑on (SSO) and mobile device management (MDM) environments—before the victim’s security stack can react. The use of AI for automated threat profiling means traditional rule‑based detection can be bypassed, as the malware adapts its behavior in real time to avoid signature‑based alerts. For enterprise IT teams, this represents a shift from static detection to dynamic, AI‑driven adversaries that can outpace conventional defenses. The incident implicates major security vendors: CrowdStrike, Microsoft Defender, Okta, and JumpCloud are all highlighted as potential points of failure if not properly configured. The broader industry implication is a heightened need for AI‑behavior anomaly detection and continuous monitoring of credential exfiltration patterns. As attackers adopt LLMs for rapid threat assessment, security teams must move from reactive to proactive, incorporating AI‑enabled detection into their endpoint, identity, and device management stacks.