Threat
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
First reported talosintelligence.com
Page published
Earliest dated coverage: 31 Oct 2026 · First observed: 31 Oct 2026 · Latest dated coverage: 31 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
VOLTA’s LLM integration helps operators turn stolen data into actionable victim dossiers, while its refusal-aware fallback chain reduces reliance on any single model’s safeguards.
Talos reports that VOLTA-AUTODOXER, a Windows infostealer, sends structured bundles of stolen credentials, personal information, and account data to LLMs through OpenRouter to rank victims’ assets by monetization value. The malware checks for model refusals and retries across up to three models, using AI as a post-theft profiling and prioritization service.