Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

VOLTA-AUTODOXER is a sophisticated Windows infostealer that steals credentials, session tokens, cryptocurrency wallets, and other sensitive data, then enriches the stolen data using live API calls to services like Gmail, Discord, and Roblox. It uniquely sends a structured evidence bundle to third-party LLMs via OpenRouter to generate a prioritized, AI-analyzed dossier of the victim's monetizable assets and security posture. The malware uses a fallback chain of LLMs (Claude, Kimi, Gemini) to bypass model refusals and operates without attacker-owned infrastructure, exfiltrating data in encrypted ZIP files to Telegram. It is distributed via a builder model, indicating commoditization and broad accessibility to cybercriminals.

AI-extracted · verify before operational use