AI in doxing: how it is used and how to protect yourself

While artificial intelligence offers transformative advantages across many industries, it is also a potent tool for exploitation. Cybercriminals are increasingly weaponizing AI, with doxing emerging as a particularly alarming use case. 

How AI-powered doxing works

Doxing (short for dropping documents) is the act of searching for and publicly broadcasting private or identifying information about an individual or organization without their consent. This is typically done via the internet with malicious intent. 

While digital dossier tools have existed for years, they were traditionally limited to pre-defined scripts. In contrast, AI can analyze vast datasets, cross-reference disparate information and draw sophisticated conclusions that manual tools simply cannot. Recent cases of AI-driven deanonymization serve as a reminder of the escalating risks to online privacy. Furthermore, information aggregated by AI may lack reliability as it can be sourced from fake accounts or impersonated profiles. Despite being factually incorrect, such data can still result in substantial reputational harm.

“Like almost any other digital tool, AI can be used for both good and bad purposes. It cannot be concluded that the risk of data collection on the internet exists solely due to AI, but it is safe to say that it exacerbates this risk by making it easier for cybercriminals to collect and analyze massive databases. The main task for users is to minimize their digital footprint and, before sharing anything online, always consider whether it contains valuable personal data and whether they’re ready for it to become public,” notes Tatyana Shishkova, cybersecurity expert at Kaspersky. 

Managing your digital footprint 

As much as we’d like to completely get rid of all personal digital traces, we live in a highly digitalized world and need to interact with various online services on an almost daily basis. Kaspersky shares several tips on how to manage your digital footprint more easily and how to prevent AI from collecting it. Users should start by deleting old and unused accounts, making a habit of removing those they no longer use, since they can hold personal data for years and there is always a risk it will end up in the next data leak; the list of accounts can be checked in the browser (if auto-save of credentials is enabled) or in a password manager. They should also check the privacy settings on their social media accounts, making profiles private and restricting the number of users who have access to their publications, and can learn more about the specific settings for every platform through the Kaspersky privacy checker, a portal designed to make privacy management easier.

Passwords should be managed carefully, with multifactor authentication set up wherever possible. It is highly recommended to have a separate password for each online account and to avoid including personal or identifying details, as this data may be easily collected from open sources. To manage credentials securely, Kaspersky Password Manager keeps data in a protected format and helps generate long, secure passwords without having to commit them to memory. Finally, users should find out about new leaks as fast as possible. Some online services send users a free alert if their email address shows up in a known data leak, but to make detection faster and more effective, a dedicated solution is advised: Kaspersky Premium monitors for compromised accounts linked to email addresses (up to 50 addresses can be added) and for digital identity theft linked to phone numbers. Besides reporting leaks that have already happened, Kaspersky security solutions can also stop data about you from being collected online.Read the full article about AI in doxing on Kaspersky Daily Blog.