New VOLTA infostealer uses Claude, Gemini and Kimi to rank victims by economic value

Cisco Talos disclosed a Windows infostealer named VOLTA (VOLTA-AUTODOXER) that organizes stolen victim data into an evidence package and hands it to large models, which rank it by monetization value and sort it into low, medium and high tiers. The malware calls models through OpenRouter, uses Anthropic's Claude Opus 4.6 by default, and falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash when it encounters a refusal, chaining up to three models; its 240-word system prompt asks the model to play a forensic intelligence analyst and output a victim net-worth and OPSEC assessment based only on the evidence package. The theft scope includes browser passwords and cookies, payment cards, crypto wallet seed phrases, sessions such as Discord and Steam, Microsoft OAuth tokens, SSH and cloud provider keys, Wi-Fi configurations and screenshots, and it uses stolen sessions to access Gmail receipts to verify addresses.