NIK C2 malware uses the OpenAI API for theft and remote control
Cisco Talos says the Go implant can bill a victim’s OpenAI key, log keys, and show a non-encrypting lock screen.
72
Organization
Cisco Talos
- Mentions · 7d16
- Mentions · 30d53
- All mentions94
- First seenAug 11, 2026
- Last mentioned17h ago
Timeline
94 articles · newest firstTalos finds NIK C2 Windows RAT that calls OpenAI from infected PCs
The Go implant runs more than 52 commands, bills the victim’s OpenAI key, and shows a lock screen without encrypting files.
68
Fake IT help desk calls led to remote access and VYPR ransomware
Cisco Talos says callers often knew only names and emails, and one Quick Assist session ended in ransomware.
68
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.
84
Talos finds NIK C2 Windows implant that spends victims' OpenAI keys
The Go implant dumps credentials, captures keystrokes, and can lock screens with ransomware while calling an OpenAI model on the host.
62
NIK C2 malware bills AI queries to victims' OpenAI keys
Cisco Talos says the Go implant offers more than 52 commands plus a screen-lock ransom module that encrypts no files.
73
Volt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
86
Cisco SD-WAN zero-day CVE-2026-20127 used to install KeyDrift
Talos says UAT-11473 stole suspected IPsec keys from space, defense, and policy targets; patches shipped in February 2026.
88
KeyDrift malware steals SD-WAN encryption keys via CVE-2026-20127
UAT-11473 uses a CVSS 10.0 auth bypass on Cisco Catalyst SD-WAN to plant in-process key stealers; fixes exist but no workaround.
84
Cisco patches actively exploited ASA and FTD VPN crash flaw
CVE-2026-76418, scored 8.6, lets unauthenticated attackers reload firewalls when SSL VPN uses secondary authentication.
82
Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys
CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.
92
Talos details NIK C2, an AI-enabled Windows implant seen live
Operators can dump credentials, log keystrokes, call OpenAI from the host, and deploy screen-lock ransomware.
74
Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
84
UAT-11473 used Cisco SD-WAN auth bypass to plant KeyDrift
Talos says the implant lives in controller processes, steals data-plane keys, and overlaps Volt Typhoon infrastructure.
86
Talos finds 1,400 scam emails via Staples and Dell orders
Attackers put phone-support lures in order fields so authenticated retailer mail urged victims to call attacker numbers.
62
Talos interview covers Ryan Fetterman's path into detection research
He recounts 15 years from federal SOC work and Splunk's SURGe team into Talos, including an early Pandora Song case.
16
PHP2Shell exploitation surges while most public PHP stays unpatched
Cloudflare's CEO said attempts reached millions within hours of disclosure; Ox still saw 97.5% unpatched on October 23.
86
eMudhra intermediate CA keys can be brute-forced, Cisco says
A researcher showed eight intermediate private keys from an April 2025 ceremony can be recovered in seconds.
78
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
88
PHP RCE vulnerabilities discovered in multiple versions
Two unauthenticated RCE flaws in PHP affect all builds since 5.4, with exploitation attempts reported.
85
Scammers hide callback numbers in real Dell and Staples order emails
Cisco Talos saw about 1,400 messages whose DKIM and DMARC checks still passed.
52
Attackers send authenticated phishing through Dell, Staples and other platforms
Cisco Talos saw about 1,400 Dell and Staples messages that planted callback numbers in order fields.
52
Scammers plant fake support numbers in real Dell and Staples emails
Cisco Talos linked about 1,400 messages in two campaigns that pass DKIM and DMARC because retailers send them.
52
PHP says AI review revived critical bugs first flagged in 2024
Cloudflare saw exploitation attempts Wednesday, while the foundation says Chainguard published the fix before coordinated disclosure.
76
Talos tracks two unauthenticated PHP core RCEs called php2shell
Talos had not seen exploitation as of October 21 and says about half of PHP systems may never be patched.
84
Attackers hide scam helplines in Staples and Dell order emails
Cisco Talos saw about 1,400 messages whose DKIM and DMARC checks passed while pushing victims to call.
58
Talos says AI bug mining is flooding Microsoft Patch Tuesday
This month's 1,415 Microsoft advisories far exceed a pre-June average near 100, while exploited bugs rose more slowly.
38
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cisco Talos says UAT-11985 uses fake event invites and Google AitM phishing against Taiwan research affiliates.
64
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Kazakhstan-linked Silent Lynx spies on Russia's Orsk refinery and regional governments using spear-phishing and lightweight malware.
76
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
58
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Silent Lynx used a WinRAR flaw and phishing to plant reverse shells on CIS government targets.
76
Suspected Kazakhstan-linked hackers target governments across former Soviet states
Suspected Kazakhstan-linked UAT-6275 ran at least eight espionage campaigns against former Soviet governments since 2025.
76
UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations
UAT-6275 used WinRAR CVE-2025-8088 to plant reverse shells on CIS government systems via malicious archives.
78
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Kazakhstan-linked UAT-6275 targeted CIS governments using phishing and a WinRAR exploit.
78
TAG-193’s Regional Espionage Operations
TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.
76
Microsoft Patches More Than 1,400 Security Flaws
Microsoft patched over 1,400 flaws, including an exploited Windows Shell bypass, CVE-2026-96951.
80
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, including an exploited Windows Shell zero-day.
86
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft's October 2026 Patch Tuesday fixes 1,415 flaws, including 85 critical, with one Windows Shell bug exploited in the wild.
76
Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time
Cisco Talos says UAT-11985 uses a Google AiTM kit to steal sessions from Taiwan-linked researchers.
68
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
UAT-11985 used likely AI-written event invites and an AiTM kit to steal Google sessions from Taiwan researchers.
72
Related CVEs
by mentions- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-2007988%10.0Authentication bypass to root access in Cisco Secure Firewall Management Center
- CVE-2026-2031635%5.3Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center
- CVE-2025-808894%8.4WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-9695110%8.8Windows Shell command injection bypasses a security feature
- CVE-2021-2375883%9.8Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2)
- CVE-2015-32469%7.4Race Condition in Red Hat libuser Allows Local Privilege Escalation
- Local Privilege Escalation via Symlink Attack in Red Hat ABRT
Appears with
- Ciscovendor · 37
- Microsoftvendor · 14
- Mistralai model · 12
- Qwenai model · 12
- Cisco Talosvendor · 11
- ClosedQuorummalware · 11
- Googlevendor · 10
- Windowsproduct · 10
- Geminiai model · 9
- DeepSeekai model · 9
- KeyDriftmalware · 8
- Sandwormthreat actor · 8
- Volt Typhoonthreat actor · 8
- UAT-11473threat actor · 8
- LittleFilchmalware · 7
- PolyFlamemalware · 7
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.