What happened
Cisco Talos researchers reported that a new version of the Volta infostealer puts large language models (LLMs) to work. The malware feeds the data it collects into a model, which then ranks victims by how valuable they appear to be.
Why it matters
Infostealers typically sell stolen data in bulk. In Volta, the model instead produces a priority list of which victims are likely to be most lucrative. That makes it easier for attackers to direct their time and resources at the most profitable targets.
AI enters criminal tooling
This case shows that LLMs are moving not only into legitimate products but also into malicious workflows. Bringing a model into the decision loop could make attacks more scalable and more sharply targeted.
What defenders should take away
The research suggests organizations should treat credential and session-data leaks not just as a technical incident but as a targeting risk. Talos's analysis gives defenders a case study in how this kind of automation works.
