Malware uses LLMs to rank victims by how much they're worth

VOLTA is a self-deleting Windows infostealer that uses large language models to automatically rank victims by their financial value after stealing their credentials, wallets, and personal data. After harvesting sensitive information like passwords, crypto wallets, and session tokens, the malware sends a structured bundle of victim data to an LLM via OpenRouter, which analyzes and prioritizes monetizable assets and security weaknesses into a "target assessment." This represents a shift in cybercrime tactics where AI is used as an intelligence analyst to triage stolen data at scale, with built-in failover mechanisms to bypass model safety guardrails.