New malware steals your logins, then asks AI what you're worth

Infostealers usually dump the loot and leave a human to sort it. VOLTA hands that job to an LLM. Cisco Talos says the Windows stealer, first seen on 11 October, sends its haul to OpenRouter with a prompt casting the model as a forensic intelligence analyst. The required output includes "WHAT THEY'RE WORTH", which sorts valuables into low, medium and high monetization tiers, and "THEIR OPSEC", which assesses security and password habits.

The dossier goes well beyond passwords. VOLTA takes browser credentials, cookies, payment cards, crypto wallets and SSH keys, then uses stolen sessions to add detail. It searches Gmail receipts to confirm a home address, pulls Uber Eats and DoorDash order history, and prices Roblox inventory through a live lookup.

The default model is Claude Opus 4.6. If the reply contains a refusal phrase such as "I can't", VOLTA retries with Kimi K2, then Gemini 2.5 Flash. The AI step is optional: without an API key, the malware still steals everything and skips the dossier. Talos infers from build-time slots for buyers' own API keys and Telegram channel that the tool is probably sold to other criminals. It names no threat actor and reports no confirmed victims.

Talos calls the AI's value effort displacement: it replaces an operator's analysis rather than adding speed or scale.

Why it matters: one model's refusal doesn't stop malware that is built to fall back to another.