GoKawiilVOLTA-AUTODOXER stealer uses LLMs to score stolen victim data for monetization value
Researchers at the CAIRN project identified a Windows infostealer called VOLTA-AUTODOXER that harvests credentials, crypto wallets, session tokens and personal data, then sends a structured profile of the victim to a large language model via OpenRouter. The model is prompted to act as a forensic intelligence analyst and rank how valuable the victim's compromised assets and identity are for further exploitation. The malware self-deletes after operation and has no attacker-controlled infrastructure, relying instead on cloud AI services to do its analysis.