Cisco Talos researchers have analyzed VOLTA-AUTODOXER, a self-deleting Windows infostealer that integrates a multi-model LLM pipeline to triage stolen data and rank victims by monetization value. The malware harvests browser credentials, cookies, payment cards, cryptocurrency wallet seeds (cracking vaults inline), Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots. It then performs live enrichment using stolen sessions: querying Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to confirm home addresses; pulling UberEats and DoorDash order histories; enriching Discord profiles via tokens; and valuing Roblox inventories via Rolimons.com lookups. The structured evidence bundle—containing geolocation, employer details, inferred birth year, card last-four digits, Slack workspaces, document metadata, and iPhone backup indicators—is serialized as JSON and POSTed to OpenRouter (https://openrouter.ai/api/v1/chat/completions) under a system prompt instructing the model to act as a forensic intelligence analyst. The prompt demands a "WHAT THEY'RE WORTH" section with low/medium/high monetization tiers and a "THEIR OPSEC" assessment of security posture and password hygiene. VOLTA employs a cascading fallback chain—defaulting to anthropic/claude-opus-4.6, then moonshotai/kimi-k2, then google/gemini-2.5-flash—at temperature 0.2, detecting refusals via phrases like "I can't" before pivoting. The builder-model deployment uses six encrypted configuration slots (keys derived from SHA-256 of binary constants) for Telegram channels and API keys, suggesting commoditized sale. All infrastructure is third-party; no actor-owned C2 exists. Exfiltration occurs via the victim's network as volta_dox.zip containing Identity_Report.txt and AI_Analysis.txt. Defenses include restricting Chrome --headless launches to block App-Bound Encryption bypasses, monitoring for APPDATA%\volta_debug.txt harvest logs, revoking compromised tokens, and migrating cryptocurrency wallets if seeds were exposed.