AI valuation: the VOLTA infostealer uses LLMs to grade victims

CSA research notes interpret Cisco Talos's analysis of the Windows infostealer VOLTA, which after stealing credentials can send the victim's profile to commercial large language models to automatically assess its monetization value and security-habit weaknesses. The malware calls models via OpenRouter, defaulting to Claude Opus 4.6, and upon detecting refusal wording falls back in sequence to Kimi K2 and Gemini 2.5 Flash; the profile contains address, employer, inferred birth year and payment card information, with the address confirmed via receipts in the victim's Gmail. The notes hold that AI has entered the post-theft monetization stage rather than only code generation, potentially letting attackers pick high-value targets from the more than 50 million stolen logs on underground channels in 2025 counted by Flare, and that a single model's refusal cannot stop attackers using aggregators. The notes also state that evidence is limited, that Talos analyzed only a single sample, and that the distribution vector and actual harm are unconfirmed.