Malware uses LLMs to rank victims by how much they're worth

	Malware uses LLMs to rank victims by how much they're worth(blog.talosintelligence.com)
	249 points by khalidkhair 22 hours ago \| 131 comments
	tl;dr: VOLTA-AUTODOXER is a Windows infostealer that, after harvesting credentials, cookies, wallets, and session tokens, sends a structured victim profile to OpenRouter-hosted LLMs (defaulting to Claude, falling back to Kimi and Gemini) to generate a ranked "target assessment" dossier identifying monetizable assets and OPSEC weaknesses. The malware uses a swappable build-time template suggesting it's sold as a commodity builder, and includes refusal-resilience logic that detects LLM guardrail responses and retries with more permissive models. Notably, there's no attacker-owned infrastructure—inference runs through the victim's own network before exfiltration.
	HN Discussion: ↑Rapid software update cycles create widening attack surfaces, prompting extreme compartmentalization measures ↑We're entering a new era of agent-based threats reminiscent of early-2000s virus storms •Defensive prompt injection in local data could become a counter-measure in an AI arms race ↑AI labs should be running classification on outputs to detect malicious usage patterns •Running inference on victim machines is an odd but commercially pragmatic design choice