The Shelf · Signal Library
No. 159

Malware now uses LLMs to rank victims by how much they're worth

UnverifiedEvidence grade
Nov 1, 2026Shelved
Also worth a lookSection
sha256:391f0e6f7c42…Fingerprint

Cisco Talos documents the Volta infostealer using AI-model-driven victim prioritization ("appraisal") to sort stolen data by estimated value; a documented incident, and a concrete picture of how commodity malware is absorbing LLMs.

Read the source — Cisco TalosBrowse the Shelf

Cite as — Sawdust Shelf v2026-11-05.3 · No. 159 · fingerprint sha256:391f0e6f7c42…
Share image rendered from the living shelf — the number, the grade and the fingerprint travel with the card.