Security · November 3, 2026
Also published in Português (Brasil)
Malware Uses Large Language Models to Rank Victim Value
Researchers have identified a data stealing tool called VOLTA that uses an artificial intelligence integration module to evaluate the financial value of its victims.
The malware, also referred to as VOLTA-AUTODOXER, targets Windows systems. It collects a wide range of data, including browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, and session data from Discord, Telegram, Steam, and Roblox. It also gathers Microsoft OAuth tokens, SSH and cloud service keys, Wi-Fi profiles, and screenshots.
To build a detailed profile, the tool extracts geolocation, home addresses, workplaces, estimated birth years, and the last four digits of card numbers. It identifies Slack workspaces, document authorship metadata, iPhone backup indicators, and the estimated value of Roblox accounts. The software further enriches this data by using stolen session tokens to search Gmail for purchase receipts, extract order histories from UberEats and DoorDash, and gather additional details from Discord accounts.
This collected information is sent via a POST request to the OpenRouter platform. The malware uses a system prompt that instructs a large language model to act as an analyst collecting and evaluating target data. The model is required to produce a section titled WHAT THEY'RE WORTH, which classifies assets by potential monetization levels as low, medium, or high. It also creates a section titled THEIR OPSEC to assess the victim's security and password quality.
To ensure accuracy and consistency, the malware uses a fixed temperature setting of 0.2. Because the operators expect some models to refuse these requests due to built-in guardrails, the software is designed to switch to a chain of three other models if the first one fails.
Beyond data collection, the tool includes a built-in utility to crack cryptocurrency wallet vaults, recording the results in a section titled WALLET VAULTS CRACKED. The malware is designed to delete itself after operation and does not use infrastructure owned by the attackers.