Malware uses LLMs to rank victims by value
The gist
Cisco Talos documented VOLTA-Autodoxer, a Windows infostealer that sends victim data to LLMs to rank assets by value.
The finding shows commercial AI models being folded into established malware.
How it unfolded
- Oct 31, 2026Cisco Talos researchers document VOLTA-Autodoxer, which sends a structured evidence bundle to an LLM to rank victims' assets by monetization value.
- Oct 31, 2026Talos publishes its analysis of VOLTA's LLM victim-profiling stage, authored by researcher Ryan Fetterman.
- Oct 31, 2026Talos flags VOLTA under its new CAIRN framework, built to identify hacking tools that incorporate AI capabilities.