Malware Scours Gmail Receipts, Uses Claude to Appraise You, and Switches to Kimi If Refused

The Cisco Talos security research team recently disclosed a Windows infostealer. It does something straightforward: steals passwords, bank cards, and crypto wallets, then deletes itself after running.

Hesamation relayed Talos's findings on X. The infostealer also performs an 'appraisal' step: it uses Claude Opus 4.6 to analyze whether a victim is worth targeting and ranks the most valuable assets. It digs through Amazon and DoorDash receipts in Gmail. Purchase records, food-delivery records, and spending frequency together form a rough financial profile.

The image shows the VOLTA-AUTODOXER workflow: first collect files, credentials, sessions, financial, identity, and behavioral data; then correlate and bundle them; generate an identity report; add AI analysis if present; and finally exfiltrate to a Telegram C2. The optional AI analysis in the middle is used to enrich, correlate, and infer profile content. At the bottom is its configuration: Go deep, not wide... Be blunt, specific, accurate.

If Claude refuses, the program switches to Kimi K2, then to Gemini 2.5 Flash. All calls go through OpenRouter. According to Talos, the trigger condition for the entire fallback chain is crude: check whether the model's reply contains 'I can't' or 'I'm not able'; if so, switch to the next model. It chains at most three models.

This practice of using model routing to bypass guardrails is becoming common in cyberattacks. Routing originally existed for availability, cost, or failover; now a refusal has also become a routing signal.

One reply said the wealth estimate doesn't need to be accurate; as long as someone gets targeted, that's enough. The logic is not complicated. Even a wildly wrong appraisal can push someone up the priority list.

Another reminder came from the replies: when cleaning up this kind of infostealer, changing passwords is only half the job. Stolen browser session cookies remain valid until they expire. You need to revoke all active sessions in identity providers and major SaaS applications to kick the attacker out.

Original Talos post: https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/