conv.

All stories
SecurityQuiet 11d · day 12

Malware VOLTA uses LLMs to rank victims by financial worth

A new Windows infostealer steals credentials across dozens of platforms, then deploys LLMs via OpenRouter to profile and prioritize targets by monetizable assets.

newest coverage 10d agosummary written 11d ago28 pieces282 likes & upvotes137 comments Hacker NewsNewswiresMastodon

What to know

  • VOLTA-AUTODOXER combines broad credential theft across dozens of platforms with LLM-powered victim profiling, automating the prioritization of targets by financial value.
  • The malware uses OpenRouter to send stolen data bundles to an LLM instructed to rank victims' monetizable assets and assess their security posture, bypassing model refusals via fallback to multiple permissive models.
  • The attack demonstrates a new pattern in cybercrime: mass data collection followed by AI-driven triage, allowing attackers to scale targeting and focus on high-value victims without manual analysis.

“The system prompt directly reveals the operator's use case: Produce a concise analytical assessment of the victim's suitability as a target, backed by an auditable trail of citations.”

Cisco Talos Intelligence · Cisco Talos blog ↗

Cisco Talos Intelligence Malware researcherCAIRN research effort Research collaborationOpenRouter LLM API service

Malware VOLTA uses LLMs to rank victims by financial worth
blog.talosintelligence.com

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 12 pieces in 3h at Oct 31, 10 AM; 28 pieces over 12 days (3 articles · 3 posts · 22 comments) Oct 31, 7 AM — 4 pieces · 3 articles · 1 post — Newswires 2, Mastodon 1, Hacker News 1Oct 31, 10 AM — 12 pieces · 2 posts · 10 comments — Hacker News 10, Mastodon 2Oct 31, 1 PM — 8 pieces · 8 comments — Hacker News 8Oct 31, 4 PM — 1 piece · 1 comment — Hacker News 1Oct 31, 7 PM — quietOct 31, 10 PM — 2 pieces · 2 comments — Hacker News 2Nov 1, 1 AM — quietNov 1, 3 AM — quietNov 1, 6 AM — 1 piece · 1 comment — Hacker News 1Nov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quietToday, 3 PM — quietToday, 6 PM — quiet 1–2
Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 9:51 PM ET
  1. 2

    Security researchers react to sophistication of VOLTA's attack chain

    The disclosure attracted attention on Hacker News and Mastodon as researchers and security professionals engaged with the report. Commentary noted both the technical sophistication of the attack and its implications for victim exposure.

    “Huge props to VOLTA creators. At least you should be comforted that you were pwnd by capable attackers vs hacked by ransomware script kiddies when it happens (note the "when").”
    — hrbrmstr@mastodon.social, Security researcher (Mastodon) · source

    • AI dev environment gets its own SSD. The second SSD stays in, but since it's encrypted there's no way to exfiltrate the data unless you're of interest to nation state attackers. Theoretically the AI could destroy the other SSD but that's what backups are for, and the probability is low because well why would they bother. Boot level malware is…

      revolvingthrowHacker News11d agoview on Hacker News ↗
    2 more of the top 3 · 23 posts in this stretch
    • hrbrmstr@mastodon.social

      Huge props to VOLTA creators. At least you should be comforted that you were pwnd by capable attackers vs hacked by ransomware script kiddies when it happens (note the "when”). https:// blog.talosintelligence.com/app raisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/

      hrbrmstr@mastodon.socialMastodon11d agoview on Mastodon ↗

    • this is what I do, and it's fairly cheap nowadays if you just buy 2nd hand, I actually go so far as having virtualbox VMs for some of those within the same computer (say I have my "important accounts" computer that has some virtualbox VMs with each a browser with only some of those).Gaming is a windows PC that has only games (so who cares) and a…

      tetraodonpufferHacker News11d agoview on Hacker News ↗
    all of them →
  2. 1

    VOLTA sends stolen data to OpenRouter for LLM-powered victim assessment

    The malware serializes the stolen bundle and POSTs it to OpenRouter under a system prompt instructing the model to act as a forensic intelligence analyst. The LLM generates a structured dossier with sections titled 'WHAT THEY'RE WORTH' (valuables ranked by monetization tier) and 'THEIR OPSEC' (security posture assessment). The malware uses a multi-model fallback architecture with up to three models, with low temperature settings (0.2) for consistency and checks for refusal phrases like 'I can't' or 'I'm not able.'

    “The model is the operator's triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.”
    — Cisco Talos Intelligence
    1. 2 outlets Malware uses LLMs to rank victims by how much they're worth

      first by HN Best, 11d ago · also HN Frontpage

    2. 1 outlet Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

      first by Mastodon, 11d ago

  3. background

    Cisco Talos discloses VOLTA infostealer with LLM-powered victim profiling — Researchers surfaced VOLTA-AUTODOXER through the CAIRN research effort, a Windows infostealer that combines credential theft with AI-driven victim ranking. After stealing passwords, cookies, payment cards, cryptocurrency wallet seeds, and session tokens from dozens of platforms, the malware constructs a data bundle about the victim including geolocation, employer, inferred birth year, and estimated Roblox account value.

What people are saying 20 voices from 1 site · best of 23 · verbatim