Cisco Talos describes the victim grading stage in the LLM infostealer VOLTA

Cisco Talos researcher Ryan Fetterman published an analysis on October 31, 2026 of the Windows infostealer VOLTA-AUTODOXER, malware that after completing a round of credential theft calls an LLM to grade victims by monetization value. In a single run, VOLTA collects credentials and cookies from Chromium, Firefox and Thunderbird, payment cards, session tokens for Slack and Discord and others, SSH and cloud service configurations, Wi-Fi profiles and screenshots, and performs cracking against wallet vaults; it then uses stolen Gmail tokens to search receipts from Amazon, DoorDash, Uber Eats and others to confirm the home address, then checks Uber Eats and DoorDash order history, queries Roblox inventory via Rolimons.com, and compiles everything into Identity_Report.txt and serializes it as JSON.