Cisco Talos details the stage in which VOLTA infostealer malware uses an LLM to rank victims

Cisco Talos researcher Ryan Fetterman published an analysis on October 31, 2026, detailing the stage in which the Windows infostealer malware VOLTA-AUTODOXER, after stealing credentials, uses an LLM to rank victims' monetizable assets. The malware extracts multiple types of credentials, including browser, messaging and cloud configurations, and uses stolen Gmail tokens to retrieve receipts corroborating addresses, organizing the evidence into JSON and sending it to OpenRouter's chat completions endpoint. Talos says its default model is anthropic/claude-opus-4.6, falling back in order to moonshotai/kimi-k2 and google/gemini-2.5-flash, with a temperature of 0.2; when a refusal appears in the reply, it switches to the next model, trying at most three. The inference is performed on the victim's endpoint and network connection, and the results are only exfiltrated afterward.