APPRAISAL BY AI: MODEL-DRIVEN VICTIM PRIORITIZATION IN THE VOLTA INFOSTEALER

Summary from the TLDR InfoSec newsletter

VOLTA takes a "steal everything, let AI sort it out" approach: it grabs credentials, sessions, wallets, and cloud keys, then uses the victim's own Gmail, DoorDash, and Discord sessions to confirm details like a home address. It sends the resulting dossier through OpenRouter to Claude, falling back to Kimi and then Gemini if a model refuses, and gets back a ranked "WHAT THEY'RE WORTH" assessment of what the victim's assets could fetch. Talos assessed VOLTA as a commodity builder that runs entirely on third-party infrastructure. They recommended that defenders block or alert on non-developer processes launching Chrome with --headless, since that is how the stealer gets around App-Bound Encryption.