Malware ranks what you're worth

Cisco Talos found a Windows infostealer, VOLTA-AUTODOXER, that serializes a structured evidence bundle about the victim and ships it to Claude Opus 4.6 with a prompt telling the model to act as a “forensic intelligence analyst” and produce a dossier with a section headed “WHAT THEY’RE WORTH.” The model ranks the victim’s valuables by monetization value in low, medium, and high tiers, and adds a section called “THEIR OPSEC” that assesses the victim’s password hygiene and general security posture.

The collection half of VOLTA looks like any other mature stealer. It takes passwords and cookies from Chromium browsers, Outlook profiles, Slack workspaces, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots. What it does with that haul is the new part. Talos researcher Ryan Fetterman describes it as building “a structured evidence bundle about the person behind the machine”: geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation.

It also does active enrichment. Using the session access it just stole, VOLTA searches the victim’s Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to corroborate the home address it inferred. That is deanonymization work a human analyst would otherwise do by hand.

The AI call

The bundle goes out through OpenRouter, a unified API gateway that routes to multiple LLM providers, carrying a 240-word system prompt. The prompt pins the model to the evidence: “The bundle is the ONLY permissible source of facts; your training knowledge must never supply a fact about the subject.” Requests default to Claude Opus 4.6. If that fails, VOLTA falls back to Moonshot AI’s Kimi K2, then Google’s Gemini 2.5 Flash.

The fallback logic is built to beat safety refusals, not just outages. VOLTA checks each response for phrases like “I can’t” or “I’m not able,” and if it sees one it passes the request down a chain of up to three models. A refusal from one vendor becomes a retry against the next.

Exfiltration runs over Telegram in three stages: once right after the stealer finishes, carrying the raw credentials, cards, wallets, tokens, Wi-Fi passwords, and screenshots; again after the AI call, carrying the captured data plus the LLM’s analysis; and a third time after the Gmail enrichment step, carrying the receipts and order histories. The operator gets a ranked, citation-backed target assessment delivered to their Telegram inbox.

Built to sell

VOLTA ships from a template with six slots filled at build time, including the Telegram exfil channel, API keys, and other settings. Talos reads that as a builder kit sold to customers, or a bespoke tool the author compiles per order. Either way the AI dossier is a product feature, not a one-off. As Talos puts it, the capability “enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments.” The gain is not speed or scale. It is effort displacement: the model does the triage a skilled operator would otherwise do, so an unskilled buyer gets the same output.

That framing matters for what you watch for. The AI layer is bolted onto a late-stage stealer, so the collection behavior is detectable by the same methods you already run. The distinctive new signal is outbound traffic to OpenRouter and Telegram’s API from a host that has no business talking to either, clustered with browser credential-store access. The Gmail enrichment means a freshly compromised account may show programmatic searches for retailer and delivery receipts shortly after a session token is lifted.

LLMjacking next door

Talos separately documented NIK C2, a Go-based Windows RAT with over 52 C2 commands covering remote access, credential theft, keylogging, defense evasion, surveillance, and ransomware, plus an OpenAI client that analyzes stolen data inside the compromised session. It checks whether the operator supplied an API key, and if none is present it scans the victim’s environment variables for “OPENAI_API_KEY” and uses that. The victim funds the inference run against themselves, and the requests trace back to the victim’s account rather than the attacker’s.

Two defensive implications follow. If you issue OpenAI or similar API keys, treat them as spendable credentials: scope them tightly, keep them out of plain environment variables where you can, and alert on usage and billing anomalies, because an unexplained inference spike may be an intruder, not your own workload. And NIK C2’s in-session analysis removes the offline processing delay that used to give defenders a detection window between collection and exfiltration, so the gap between credential access and first outbound AI call is the interval worth instrumenting.

---

Contains a referral link.

See also: NordVPN for tunneled traffic when operating outside controlled networks.

---

#ad Contains an affiliate link.