NIK C2 malware uses the OpenAI API for theft and remote control
Cisco Talos says the Go implant can bill a victim’s OpenAI key, log keys, and show a non-encrypting lock screen.
72
Malware
NIK C2
- Mentions · 7d5
- Mentions · 30d5
- All mentions5
- First seenOct 29, 2026
- Last mentioned9h ago
Timeline
5 articles · newest firstTalos finds NIK C2 Windows RAT that calls OpenAI from infected PCs
The Go implant runs more than 52 commands, bills the victim’s OpenAI key, and shows a lock screen without encrypting files.
68
Talos finds NIK C2 Windows implant that spends victims' OpenAI keys
The Go implant dumps credentials, captures keystrokes, and can lock screens with ransomware while calling an OpenAI model on the host.
62
NIK C2 malware bills AI queries to victims' OpenAI keys
Cisco Talos says the Go implant offers more than 52 commands plus a screen-lock ransom module that encrypts no files.
73
Talos details NIK C2, an AI-enabled Windows implant seen live
Operators can dump credentials, log keystrokes, call OpenAI from the host, and deploy screen-lock ransomware.
74
Appears with
- Cisco Talosorganization · 5
- OpenAIvendor · 3
- gpt-4ai model · 2
- ClamAVproduct · 1
- Ciscovendor · 1
- OpenAIorganization · 1
- SesameOpmalware · 1
- OpenAI APIproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.