Malware uses LLMs to rank victims by how much they're worth
Cisco Talos published an analysis on October 31, 2026, of a self-deleting Windows infostealer it calls VOLTA, also known as VOLTA-AUTODOXER. After taking saved passwords, session tokens, cookies and cryptocurrency wallets, the malware sends a compiled profile of the victim to a large language model. The model returns a ranked assessment of what the victim's accounts and assets might be worth to an attacker.
The prompt asks the model to act as a forensic intelligence analyst. Its output has two labeled sections: WHAT THEY'RE WORTH, which sorts valuables into low, medium and high tiers, and THEIR OPSEC, which grades password hygiene and security posture. Requests go through OpenRouter, a router that reaches several AI providers. Per summaries of Talos's analysis by Startup Fortune and DataStudios, Anthropic's Claude Opus 4.6 is the default model, and if a reply contains a refusal phrase, the malware retries with Kimi K2 and then Gemini 2.5 Flash.
Startup Fortune reports the bundle can include an inferred home address, employer, inferred birth year, the last four digits of stolen cards, Slack workspaces and a Roblox account valuation. The LLM step is optional, since the stealer still works without an API key. Talos has not tracked real-world use and does not report how widely the tool has spread or who sells it.
Why it matters
For AI companies, the notable detail is that a commercial model API has become a working step in a criminal workflow. The malware does not need a model to steal data, but it uses one to decide which victims deserve attention, a judgment criminals used to make by hand. Any startup selling model access, especially through routers or aggregators, now has a concrete example of how its endpoints can be used for victim triage.
Investors and operators should expect enterprise buyers to ask about abuse monitoring, key misuse and refusal behavior. The fallback chain shows that attackers test several providers and switch when one declines, so a safety rule that works in one model may not stop a campaign that spreads requests across them. Teams building profiling, search or agent products also face a privacy question: a model that infers personal details from sparse data is a capability that can be misused.
Key points
- 1Cisco Talos published its analysis of VOLTA on October 31, 2026, also naming it VOLTA-AUTODOXER.
- 2The malware runs its LLM step after stealing credentials, session tokens, cookies and cryptocurrency wallets.
- 3Requests are routed through OpenRouter, with Claude Opus 4.6 as the default model.
- 4Kimi K2 and Gemini 2.5 Flash serve as fallbacks when a reply contains a refusal phrase.
- 5
