Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

www.itsecuritynews.info • October 31, 2026

The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.

This article has been indexed from Cisco Talos Blog

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

VOLTA-AUTODOXER Malware Leverages AI for Victim Profiling The VOLTA-AUTODOXER malware, identified by Cisco Talos, utilizes large language models (LLMs) to rank victims based on the monetization value of their stolen data. This self-deleting Windows infostealer collects a wide range of sensitive information, including login credentials, payment card details, and personal data, and assembles it into structured evidence bundles. The malware operates without any attacker-owned infrastructure, relying on third-party endpoints for its operations. After gathering data, it enriches the victim profiles by accessing their accounts, such as Gmail and Discord, to corroborate information and assess security postures. The AI component acts as an intelligence analyst, creating prioritized dossiers of victims' assets. The malware's novel approach marks a significant evolution in cybercrime tactics, focusing on automated victim profiling and targeting high-value individuals. As of now, there are no reports of or public proof-of-concept code. 3 sources 40

Extracted Entities

Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)