Infostealer malware now asks an LLM to rank what each victim is worth

Cisco Talos describes VOLTA, a Windows infostealer that grabs browser passwords, cookies, saved cards, crypto wallets, chat and cloud sessions, then uses stolen Gmail, DoorDash and Uber Eats sessions to confirm details such as a home address. It sends the bundle through OpenRouter to an LLM, by default Claude Opus 4.6, with a prompt asking for a target assessment that ranks the victim's assets by how easily they can be monetised; if the model refuses, it falls back to Kimi K2 and then Gemini 2.5 Flash. Talos thinks it is sold through a builder, so buyers of any skill level get ranked dossiers in their Telegram inbox. On Hacker News (15 top-level comments when we read it) most replies were jokes about being too poor to rank, with a few raising worries about compromised agent tools and one noting that running the model call on the victim's machine exposes the attacker's API key; no consensus. Sorted take: the AI part is new, but the defence is still the boring basics.