Cisco Talos details VOLTA, an infostealer that hands stolen data to LLMs to rank victims by value
Talos found VOLTA-AUTODOXER, a self-deleting Windows infostealer. After stealing passwords, cookies and crypto wallets, it uses stolen sessions to mine email receipts and food-delivery orders, then sends the dossier via OpenRouter to Claude Opus 4.6 for a target assessment, falling back to Kimi K2 and Gemini 2.5 Flash on refusal. Talos has not confirmed use in the wild.
Why it matters
Malware is now using LLMs to do the attacker's analysis, with a built-in chain to switch models after refusals, testing model guardrails in a new way.
Sources2
Written by dalao.ai: the title, summary and why it matters are our own words. The original reports are the record; their publishers keep authorship.