本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Malware uses LLMs to rank victims by how much they’re worth

网络犯罪领域出现了一个新概念——撒大网、窃取一切，然后让人工智能来处理细节。一种名为“VOLTA-AUTODOXER”的新型恶意软件通过 CAIRN 研究项目浮出水面，它是一种具有自我删除功能的 Windows 信息窃取程序，通过引入基于大语言模型（LLM）的受害者画像阶段，增强了其窃取后的工作流程。

After harvesting the standard stealer haul, including browser passwords; cookies; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots, VOLTA builds a structured evidence bundle about the person behind the machine. This bundle contains geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation. It then uses stolen session access to enrich that bundle further: searching the victim’s Gmail for purchase receipts to corroborate a home address, pulling UberEats and DoorDash order history, and enriching Discord accounts via the stolen token.

该数据包被序列化并 POST 到 OpenRouter，系统提示词指示模型充当“起草目标评估报告的法医情报分析师”。所需输出包括一个标题为“他们的价值（WHAT THEY’RE WORTH）”的部分，按变现潜力将贵重物品分为低/中/高等级；以及一个关于“他们的操作安全（THEIR OPSEC）”的部分，包含对受害者安全态势和密码习惯的评估。该模型充当了操作者的分诊分析师；它将原始凭据日志转化为一份经过优先排序且带有引用支持的受害者及其可变现资产档案。

VOLTA uses a multi-model architecture to fall back resiliently if it hits a model’s refusal, checking each response for phrases like “I can’t” or “I’m not able,” before passing on to a chain of up to three models.

模型温度控制着大语言模型生成文本的随机性和可预测性。较低的硬编码温度值（0.2）表明攻击者正在强调准确性和一致性。如果发生故障，该恶意软件还会采用级联模型链。这种多模型架构表明操作者预料到了会遇到拒绝响应的情况，并会切换到几个规模较小、限制较少的模型。

The system prompt directly reveals the operator’s use case: Produce a concise analytical assessment of the victim’s suitability as a target, backed by an auditable trail of citations.

该提示词还要求完成一些不同寻常但代理模型非常擅长的任务：在稀疏且分散的数据之间建立联系。例如，鼓励将受害者的姓名、地址或大学等信息与他们的密码模式联系起来。在这种情况下，模型不是被要求去寻找数据，而是被要求扩展数据并做出有用的推断，从而提升被窃取信息的价值。

VOLTA’s capabilities are directly aligned with the records produced in modern digital life, and well beyond basic credential theft. In a single pass, the stealer can extract browser credentials, cookies, and saved payment cards across Chromium-based browsers. It hits Firefox and Thunderbird, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, and SSH and cloud-provider config files (gcloud, OpenVPN, Hide.me). VOLTA doesn’t just copy cryptocurrency wallets, but runs an embedded cracker against the vault inline, writing the result to a WALLET VAULTS CRACKED line in its own report.

机器上保存的每个 Wi-Fi 密码都会通过直接调用 WlanGetProfileList 被提取并转储为纯文本。

What really sets VOLTA apart from commodity stealers is what comes after the initial collection. There is a live enrichment pass that leverages stolen sessions to deep dive the victim’s data. For example, using the victim’s own authenticated Gmail tokens, it queries their inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal, then review those receipts to establish a confirmed home address. Stolen Uber Eats and DoorDash sessions are called directly for order history. The Discord token is re-used to enrich the victim’s account profile. Roblox inventory is valued via a live “Rolimons[.]com” lookup.

在收集和丰富阶段完成后，数据会在本地组装并结构化为一个名为“Identity_Report.txt”的文件。该文件被序列化为 JSON 格式的数据包，并与系统提示词一起 POST 到 OpenRouter。返回的有效载荷被接收为“AI_Analysis.txt”。这两个文件一起在“volta_dox.zip”中被外传。

The inference round-trip happens entirely through the victim’s own network connection, on their own machine, before the result is exfiltrated.

VOLTA 没有将 Telegram 频道、API 密钥和设置直接硬编码到代码中（这很可能是个人使用工具编写者的做法），而是使用了一个带有六个可替换插槽的模板，在构建时进行填充。

This suggests it’s a builder model: The author sells access, the customer provides their values, and the builder compiles a custom binary for each order. The credentials in those slots are encrypted, but not in a meaningful way. The key is SHA-256 of two constants sitting in the same binary, but it’s presumably there because customers expect their API keys not to be sitting in plaintext, not because it provides real protection. Anyone who reverses the file can recover them.

如果 VOLTA 确实是一种商品化的恶意软件，那么人工智能档案功能就不是作者为自己的操作而发明的。它是一项使……的功能。