VOLTA malware uses LLMs to rank stolen victims by value
Original: Malware uses LLMs to rank victims by how much they're worth
Why This Matters
AI-assisted victim triage signals a scalable new phase in credential theft operations.
A new Windows infostealer called VOLTA-AUTODOXER harvests credentials, crypto wallets, and session tokens, then sends a structured victim dossier to Claude, Kimi-K2, or Gemini via OpenRouter to rank assets by monetization potential.
Cisco Talos researchers have detailed VOLTA-AUTODOXER, a self-deleting Windows infostealer discovered through the CAIRN research effort that adds an LLM-powered triage layer to its post-theft workflow. After stealing the usual haul—browser passwords, cookies, payment cards, crypto seed phrases, Discord/Telegram/Steam sessions, Microsoft OAuth tokens, SSH keys, and screenshots—VOLTA constructs a detailed victim profile including home address, employer, inferred birth year, Slack workspaces, and even a live Roblox account valuation. It then enriches this further using stolen access: searching Gmail for purchase receipts, pulling UberEats and DoorDash order history, and querying Discord via stolen tokens. The resulting bundle is POSTed to OpenRouter under a system prompt instructing the model to act as "a forensic intelligence analyst drafting a target assessment." Required output sections include "WHAT THEY'RE WORTH"—assets ranked by monetization tier—and "THEIR OPSEC," rating the victim's password hygiene and security posture. VOLTA defaults to Claude Opus 4.6, falling back to Moonshot AI's Kimi-K2, then Gemini 2.5 Flash if a model refuses. It checks responses for phrases like "I can't" before moving to the next model in the chain—evidence of deliberate engineering around guardrails. Temperature is set to 0.2 for consistent output. There is no attacker-owned infrastructure; all traffic routes through OpenRouter. Talos notes the AI is not augmenting a traditional malware capability—it's acting as an intelligence analyst, turning raw credential logs into prioritized, citation-backed dossiers.