Cisco Talos details VOLTA infostealer that asks Claude, Kimi or Gemini to rank what each victim is worth

Talos's write-up says the self-deleting Windows stealer builds a dossier from stolen passwords, cookies, wallets and sessions, enriches it from the victim's Gmail and delivery orders, and posts it via OpenRouter to anthropic/claude-opus-4.6 by default, failing over to kimi-k2 and gemini-2.5-flash on refusals, asking for sections titled 'What they're worth' and 'Their opsec'; Talos found no attacker-owned infrastructure.