VOLTA malware uses language models to assess victims' value
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
Language models are beginning to automate not only hacking but also the analysis of stolen data: attackers can find valuable accounts faster while stolen sessions remain active.
Cisco Talos described VOLTA-AUTODOXER, a Windows stealer that builds a dossier on a device's owner after stealing passwords, sessions, keys and cryptocurrency wallets. The malware enriches it with email and order-history data, sends it to a language model through OpenRouter and asks the model to rank assets by monetization potential and assess the victim's security posture. The primary model in the code is Claude Opus 4.6, with Kimi K2 and Gemini 2.5 Flash as fallbacks if it refuses. Here SI does not replace the stealer's functions but acts as a post-theft analyst, speeding up the selection of the most valuable targets. Talos found the sample through its CAIRN research effort; WIRED notes that the researchers did not track its use in real-world attacks.
Sources 2