AI malware ranks victim value

Cisco Talos says the VOLTA infostealer can send stolen data to a large language model, which assesses a victim’s assets and ranks them by how readily they might be monetized. The data can include credentials, payment details, work accounts and information gathered from the victim’s email and delivery-app history. The model’s job isn’t to steal the data. It’s to help the operator decide which victim may be worth pursuing. Talos’ report describes the malware checking for model refusals and trying other models if needed.

For an owner or operator, the point is that AI can help attackers make better use of information they’ve already stolen. A compromised employee account or device could expose more than a password, it could give an attacker material to build a profile and assess what’s valuable. That makes it important to plan for AI being used on the other side of an attack, not just by staff. Talos also describes steps to limit VOLTA’s collection, including restricting which processes can launch Chrome in headless mode, and recommends revoking potentially compromised tokens and changing passwords after a suspected compromise.

This is the kind of risk businesses should consider when evaluating AI use.