Cisco Talos finds a malware that uses commercial LLMs to rank theft victims

Cisco Talos published a finding this morning. A Windows infostealer called VOLTA sends the data it just stole to a commercial LLM. The model is asked to rank the victim's assets by what they are worth.

Talos researcher Ryan Fetterman wrote the post. He says VOLTA is the first infostealer his team has seen that uses a language model as its own analyst. Earlier malware used language models to write code. WIRED's Lily Hay Newman and Matt Burgess reported the finding in parallel in their Kernel Panic newsletter.

What VOLTA takes, and what it then asks a model

VOLTA sweeps a Windows machine for the usual stealer haul. Talos lists browser passwords, cookies, payment card numbers and cryptocurrency wallet seed phrases. It also grabs Microsoft OAuth tokens, SSH keys and cloud provider keys. Active Discord, Telegram, Steam and Roblox sessions are included.

Then it does a second pass. It uses stolen session access to search the victim's Gmail for purchase receipts. It pulls UberEats and DoorDash order history. It enriches Discord accounts via the stolen token. Talos says the final evidence bundle holds the victim's home address, employer and inferred birth year. The bundle also records card last-4 digits, Slack workspaces and a live Roblox account valuation.

That bundle is serialized and POSTed to OpenRouter. OpenRouter is a service that sends one request to many AI providers. The system prompt tells the model to act as a forensic intelligence analyst drafting a target assessment. The output has two sections. One is titled WHAT THEY'RE WORTH, the other THEIR OPSEC.

The model fallback chain

VOLTA defaults to Anthropic's Claude Opus 4.6. Talos recorded the exact endpoint and model name in the post. The temperature is set to 0.2, which Talos reads as the attacker wanting consistent output.

If the model refuses, VOLTA checks the reply for phrases like "I can't" or "I'm not able" and falls back. The next model is Moonshot's Kimi K2. If that also refuses, the chain goes to Google Gemini 2.5 Flash. Talos says the fallback cascade "suggests the operator is anticipating encountering refusals."

Fetterman told WIRED the system prompt was crafted not to imply anything overtly malicious. He added that VOLTA still works without the model. The AI calls are, in his words, "above and beyond."

What the finding means for a team that ships a public LLM API

The guardrails on Claude Opus 4.6 are strong enough that the attacker expected to hit them. The response is a cheap one for the operator. Add two more model names to a config file. Point the next request at Kimi K2, then at Gemini 2.5 Flash.

So guardrails inside one model are not where this stops. The fix the field needs is observability on how a public API is being used. A signature across providers would help: an evidence bundle that fits a known template is a signal that provider abuse rules were written to catch. Talos says it saw no in-the-wild use of VOLTA, so the sample so far is one. But the paper has been written and the technique is now cheap for the next operator to copy.

Source

Primary source: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer, by Ryan Fetterman at Cisco Talos. Reporting: Spooky New Infostealer Malware Uses AI to 'Autodox' Victims, by Lily Hay Newman and Matt Burgess at WIRED.