VOLTA Infostealer Routes Stolen Logs Through Claude Opus for Monetization Scoring

The malware collects browser credentials, OAuth tokens, payment cards, crypto seeds, and live Gmail receipts, then constructs a 240-word forensic prompt that forces the model to cite only the provided bundle. Refusal strings trigger fallback to Kimi K2 and Gemini 2.5 Flash. Talos telemetry shows three-stage exfiltration: initial log, post-LLM dossier, and enriched receipts. This architecture shifts operator workload from manual triage to model output review.

Prior stealers such as RedLine and Raccoon dumped raw archives for human analysts. VOLTA's template-based builder and multi-model retry logic indicate a commodity offering where low-skill buyers receive pre-scored targets. The pattern matches earlier commoditization of credential parsing scripts but adds an AI layer that displaces analytical labor rather than increasing volume.

Contractor job postings and procurement records show rising demand for LLM integration skills in red-team tooling; the same routing patterns appear in open-source pentest frameworks. If VOLTA builder sales continue, expect copycat implementations embedding local models to evade API logging.

Next indicators include Telegram channel reuse across multiple builder variants and OpenRouter key patterns in sandbox detonations within 90 days.