Malware uses LLMs to rank victims by how much they're worth
The point
Cisco Talos reports VOLTA, a self deleting Windows infostealer, steals credentials, sessions, and crypto wallets, then sends a structured evidence bundle to an LLM via OpenRouter. The model ranks valuables by monetization value and grades security posture. If a model refuses, VOLTA fails over through up to three models.
Why it matters
For defenders, AI here is triage, not theft, and refusal failover is now part of the threat model.
Key details
- Default model: anthropic/claude-opus-4.6, then moonshotai/kimi-k2 and google/gemini-2.5-flash
- Bundle includes geolocation, employer, card last 4 digits, and Gmail receipts
Original ~7 min → 25 sec here Source: Cisco Talos, Oct 31, 2026