Malware uses LLMs to rank victims by how much they're worth

Security researchers uncovered a Windows infostealer called VOLTA, self-named VOLTA-AUTODOXER, that integrates large language models directly into its post-theft workflow to appraise and rank victims based on their financial and personal value. Discovered through the CAIRN research effort and detailed in blog.talosintelligence.com's report by Ryan Fetterman on October 31, 2026, the malware operates without attacker-owned command infrastructure. Instead, the self-deleting implant collects credentials, queries victim accounts across web services to enrich its findings, and contacts third-party artificial intelligence endpoints to draft a structured target assessment before exfiltrating the dossier.

This piece details the inner mechanics, model failover chains, exfiltration methods, and host-level mitigation steps surrounding VOLTA. It is written for system administrators, incident responders, enterprise defense teams, and security analysts evaluating emerging artificial intelligence integrations in cybercrime tooling. By delegating data triage to automated model prompts, the malware builder converts broad credential harvesting into an automated forensic profiling pipeline.

Malware uses LLMs to rank victims by how much: what actually changed

Traditional infostealers harvest large volumes of raw credential dumps, leaving operators to sift manually through thousands of text files, cookie archives, and database exports to identify high-value targets. VOLTA changes this model by introducing an automated post-exploitation appraisal phase that turns raw host artifacts into an intelligence dossier. Rather than relying on operator scripts to filter logs on a centralized server, the implant runs local data collection, enriches the findings using active session tokens, and queries an external model from the victim's host to evaluate target profitability before data leaves the system.

The engineering focus shifts the role of artificial intelligence from basic code generation or malicious text authoring to active analytical triage. The model receives an assembled evidence bundle and acts as an automated forensic analyst, evaluating password hygiene, financial holdings, and digital accounts. By offloading target classification and valuation directly to an external endpoint, the malware operator avoids the overhead of managing dedicated parsing infrastructure while transforming unstructured credential dumps into prioritized leads organized by monetization potential.

Malware uses LLMs to rank victims by how much: how it works

VOLTA initiates its run on Windows systems by harvesting browser passwords, cookies, and payment cards across Chromium-based browsers, Firefox, Thunderbird, and Outlook. It collects Discord tokens, Telegram sessions, Steam and Battle.net sessions, Roblox accounts, Microsoft OAuth tokens, and configuration files for SSH, gcloud, OpenVPN, and Hide.me. It extracts plaintext Wi-Fi passwords via WlanGetProfileList and executes an inline cracker against discovered cryptocurrency wallet vaults. The malware then uses authenticated Gmail tokens to search inboxes for purchase receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to verify home addresses. Stolen Uber Eats and DoorDash session data are queried directly for order histories, while Roblox inventory is appraised via live requests to Rolimons.com.

Once collection and enrichment finish, VOLTA compiles an Identity_Report.txt file and serializes it into a JSON payload. It transmits this payload to the OpenRouter chat completions endpoint at https://openrouter.ai/api/v1/chat/completions using a Mozilla/5.0 User-Agent without software development kits. A hardcoded system prompt instructs the model to draft a target assessment containing a section titled WHAT THEY'RE WORTH with low, medium, and high monetization tiers, alongside a section titled THEIR OPSEC detailing security posture. The request specifies a deterministic temperature of 0.2. If the default anthropic/claude-opus-4.6 model refuses the task, VOLTA scans responses for refusal phrases like "I can’t" or "I’m not able" and executes a fallback chain to moonshotai/kimi-k2 and then google/gemini-2.5-flash. Exfiltration packages include volta_log.zip, volta_dox.zip containing AI_Analysis.txt, and volta_doxnet.zip.

Malware uses LLMs to rank victims by how much: why it matters now

The architecture of VOLTA signals that cybercrime tooling is adopting commercial model routing services to displace manual analytical effort. The malware operates entirely against third-party endpoints, eliminating the requirement for attacker-maintained command-and-control servers. By routing requests through OpenRouter, the operators utilize commercial application programming interfaces to process stolen personal data without hosting local model weights or exposing their operational servers to takedowns.

Furthermore, the implementation of a multi-model fallback chain reveals intentional engineering designed to bypass safety filters. Cybercriminals anticipate that frontier models will enforce guardrails against drafting targeting assessments from stolen personal information. By hardcoding automated failovers from primary models to smaller, more permissive alternatives, the developer maintains operational continuity without human intervention. This commoditizes automated target analysis for purchasers of varying technical sophistication.

Malware uses LLMs to rank victims by how much: who is affected

Any Windows workstation compromised by the VOLTA implant faces deep exposure spanning personal, corporate, and gaming assets. Organizations whose staff manage cloud environments are vulnerable because VOLTA specifically targets gcloud configurations, SSH keys, OpenVPN settings, and Microsoft OAuth tokens. Enterprise communications are similarly exposed through the automated theft of Slack workspace credentials, Thunderbird files, and Outlook profiles.

Individual users suffer exposure across everyday digital services and financial assets. The stealer targets cryptocurrency vaults directly with an inline cracker, extracts complete Wi-Fi network histories in plaintext, and bypasses App-Bound Encryption in Google Chrome to capture stored browser secrets. The subsequent enrichment pass exposes home addresses via delivery platform receipts from Uber Eats, DoorDash, Grubhub, Walmart, and Amazon, while also harvesting inventory value from consumer gaming accounts on Steam and Roblox.

Malware uses LLMs to rank victims by how much: what to watch

Defenders should monitor process creation behavior around Google Chrome, specifically flagging or blocking instances where processes launch Chrome using the --headless flag, which VOLTA uses to bypass App-Bound Encryption. Implementing application control policies that restrict unauthorized processes from initiating headless browser sessions neutralizes this decryption mechanism. Security teams should also inspect outbound network traffic from endpoints directed toward the OpenRouter API completions endpoint.

Following an infection, the primary VOLTA binary deletes itself, but incident responders should inspect the local system for %APPDATA%\volta_debug.txt. This timestamped harvest log records the extracted data points and confirms whether the external model assessment completed successfully. Impacted organizations must revoke all session tokens, rotate corporate credentials, and immediately migrate cryptocurrency funds to new addresses generated on air-gapped hardware if wallet seed phrases were stored on disk.