VOLTA Infostealer Uses LLM Chain to Rank Victim Assets
VOLTA-AUTODOXER is a self-deleting Windows infostealer that integrates a multi-model LLM pipeline to automatically triage stolen credentials and rank victims by monetisation value, functioning as an AI-powered intelligence analyst for cybercriminals. The malware submits a structured victim evidence bundle to OpenRouter-hosted models—defaulting to Claude with Kimi-K2 and Gemini fallbacks—and prompts the model to produce a prioritised 'target assessment' dossier. The fallback chain, specifically engineered to bypass model refusals, represents a meaningful escalation in adversarial LLM abuse within commodity malware.