# Cisco Talos Finds an Infostealer That Asks an LLM to Rank Each Victim's Worth, and Fails Over When the Model Refuses

Times of AI Desk · 2026-11-01 · Security

[https://timesof.ai/2026/11/cisco-talos-volta-infostealer-llm-ranks-victims-refusal-fallback](https://timesof.ai/2026/11/cisco-talos-volta-infostealer-llm-ranks-victims-refusal-fallback)

> Cisco Talos says the VOLTA infostealer bundles a victim's stolen data into a dossier and sends it through OpenRouter to Claude Opus 4.6 by default, falling back to Kimi K2 and then Gemini 2.5 Flash if a model refuses, to rank what the victim is worth. The AI stage is optional, and Talos did not track whether VOLTA has been used in the wild.

VOLTA does not use AI to break in. It uses a model as the analyst who sorts the loot, and its authors assumed the first model would say no. The design detail that matters for model providers is the hard-coded chain of fallbacks, which treats a refusal as a routing problem rather than a stop.

## What Talos found

Cisco Talos researcher Ryan Fetterman describes VOLTA, which calls itself "VOLTA-AUTODOXER," as a mature, self-deleting Windows infostealer with an optional AI layer, in a report dated October 31. After taking browser passwords, cookies, payment cards, crypto-wallet seed phrases, Microsoft OAuth tokens and Discord, Telegram, Steam and Roblox sessions, it uses the stolen sessions to gather more, for example searching the victim's Gmail for receipts to confirm a home address and pulling Uber Eats and DoorDash order history, Talos says.

It then sends the bundle to OpenRouter with a system prompt telling the model to act as "a forensic intelligence analyst drafting a target assessment." The required output includes a section headed "WHAT THEY'RE WORTH," ranking the victim's valuables by how easily they can be turned into money, and an assessment of the victim's security habits, according to Talos.

The default model is anthropic/claude-opus-4.6. If the reply contains phrases such as "I can't" or "I'm not able," VOLTA moves on to moonshotai/kimi-k2 and then google/gemini-2.5-flash, Talos says. "They're building in the expectation to potentially hit model refusals at first request," Fetterman told Wired. The malware still works without the AI stage if no key is present.

Talos says VOLTA's build template, with six swappable slots for settings such as API keys, suggests it is sold to customers rather than used by a single operator. Fetterman told Wired that Talos did not track whether VOLTA has been used in the wild. The finding adds to recent reports of attackers using AI agents, such as the [ARTEX framework CrowdStrike tied to a China-nexus group](https://timesof.ai/2026/10/crowdstrike-vapor-panda-artex-deepseek-200-organizations).

## Limits

- This rests on one vendor's analysis of a sample. Talos lists a first-seen date of October 11, 2026, but gives no victim count and no evidence of a campaign.
- Talos does not say whether any model in the chain actually refused, or how the models answered when they were called.
- Anthropic, Moonshot AI, Google and OpenRouter have not commented in the sources we read.

## Sources

- [Cisco Talos: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer (October 31, 2026)](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/)
- [Wired: Spooky New Infostealer Malware Uses AI to 'Autodox' Victims (October 31, 2026)](https://www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/)