206 points·86 comments

Volta Infostealer Leverages LLMs to Prioritize Victim Loot

Hacker News · Malware uses LLMs to rank victims by how much they're worth

LLMsSecurity

What is Malware uses LLMs to rank victims by how much they're worth?

The self-deleting Windows infostealer VOLTA harvests passwords, crypto seed phrases, session tokens and other credentials. It then packages the data and queries a large language model, which ranks the victim’s assets by monetary value for the attacker.

Who it is for

Security teams and endpoint managers need to know AI can now act as an automated analyst for thieves, so they should watch for suspicious outbound LLM calls and tighten monitoring.