VOLTA infostealer uses LLMs to rank victims by financial value

A new Windows infostealer called VOLTA-AUTODOXER leverages Claude, Gemini, and Kimi AI models to categorize stolen credentials by monetization value. The malware harvests passwords and cookies from Chromium browsers, Outlook profiles, and Slack workspaces. Researchers discovered this AI-enhanced targeting approach among typical data theft capabilities. The use of LLMs to prioritize victims based on financial value represents an escalation in infostealer sophistication and attack efficiency.