x47.c (Malware): news timeline & CVEs

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

Seller WraithTools offers the x47.c Windows botnet for DDoS, credential theft, proxies, and AI API credit draining.

Qrator reports that seller WraithTools is advertising the x47.c Windows botnet. In early August the base package was $200, a DDoS add-on $150, and the full package $950. Its panel offers 18 DDoS methods, SOCKS5 proxies, browser credential theft, fast-flux control, and an AI drain that spends OpenAI or xAI credits with a supplied key. An advertised AI stealth module calls xAI Grok to pick persistence actions, with local fallbacks if the model call fails.

SecurityWeekSep 26, 12:00 UTC · 21h agoMalware 2 sources2· 1 read

Windows Botnet x47.c Offers AI API Draining, 18 Attack Methods

New Windows botnet 'x47.c' offers 18 attacks, including a novel method to drain victims' paid AI API credits.

Qrator Research Labs has documented a new Windows botnet called x47.c, sold by threat actor WraithTools. The botnet's most notable feature is an 'AI API drain' command that can exhaust a victim's paid AI service credits (e.g., OpenAI, xAI) by sending repeated billable requests directly to the provider. The malware also offers DDoS, credential theft, SOCKS5 proxying, and an 'AI Stealth' module that uses the Grok model to automate persistence and evasion on infected hosts.

Infosecurity Magazineupdated Sep 26, 12:00 UTC · 21h agofirst Sep 23, 14:00 UTC · 3d agoMalware 2 sources

x47.c

Timeline2 articles

Appears with

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

Windows Botnet x47.c Offers AI API Draining, 18 Attack Methods