Malware Uses Large Language Models to Rank Victims by Financial Value
November 3, 2026 · 2 min read
Also published in Português (Brasil)
Researchers have identified a data theft tool called VOLTA that uses an artificial intelligence integration module to evaluate the potential financial gain from a victim's assets.
The malware, also referred to as VOLTA-AUTODOXER, is a self deleting stealer for Windows. It collects a wide range of data, including browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, and session data from Discord, Telegram, Steam, and Roblox. It also targets Microsoft OAuth tokens, SSH and cloud service keys, Wi-Fi profiles, and screenshots.
To build a profile of the device owner, the tool gathers geolocation, home addresses, workplaces, estimated birth years, and the last four digits of card numbers. It extracts Slack workspaces, document authorship metadata, signs of iPhone backups, and the estimated value of Roblox accounts. The program further enriches this data by using stolen session tokens to search Gmail for purchase receipts, order histories from UberEats and DoorDash, and additional details from Discord accounts.
This structured data package is sent via a POST request to the OpenRouter platform. A system prompt instructs the model to act as an analyst collecting and evaluating target data. The model is required to produce a section titled WHAT THEY'RE WORTH, which classifies assets by monetization level as low, medium, or high, and a section titled THEIR OPSEC, which assesses the victim's security and password quality.
The malware uses a fixed temperature setting of 0.2 to ensure accuracy and consistency. To bypass built in safety guardrails, the tool employs a cascade chain of models: if one model refuses to perform the evaluation, VOLTA switches to a sequence of three other models.
Beyond simple theft, the tool identifies connections between fragmented data, such as linking personal names and addresses to specific passwords. It also includes a built in tool to crack cryptocurrency wallet vaults, recording the results in a section titled WALLET VAULTS CRACKED.