NIK C2 malware uses the OpenAI API for theft and remote control
Original title: Hackers Weaponize OpenAI API in NIK C2 Framework for Credential Theft and Remote System Control
Cisco Talos says the Go implant can bill a victim’s OpenAI key, log keys, and show a non-encrypting lock screen.
Cisco Talos says NIK C2 is a Go-based 64-bit Windows remote-access implant that talks to operators over encrypted WebSockets and a fast HTTP backup. Operators can dump browser and wallet data, log keystrokes, and take hidden desktop control. An ai_generate command sends prompts from the victim machine to OpenAI Chat Completions, falling back to the local OPENAI_API_KEY. A lock-screen module shows a payment page but does not encrypt files.
Unconfirmed: Talos assigns only moderate confidence that NIK C2 is an operational framework rather than a proof of concept.
- Talos published on October 29 and calls it a working framework with moderate confidence.
- The implant uses TLS WebSockets on port 443 and HTTP check-ins about every 250 milliseconds.
- With no supplied key it reads OPENAI_API_KEY and defaults to gpt-4.
- It copies browser data, Wi-Fi passwords, Discord tokens, and named crypto wallets.
- The lock-screen module backs up the MBR but does not encrypt files.
Impact: Credential theft, keylogging, hidden desktop control, and lock-screen extortion
- 1.Hunt suspicious files with Talos’s CAIRN toolkit for AI endpoints and API-key patterns.
- 2.Match the published NIK C2 IP, domain, certificate, and dropped-file indicators.
- ATT&CK
- T1555.003 Credentials from Web BrowsersT1056.001 KeyloggingT1548.002 Bypass User Account ControlT1036.005 Match Legitimate Name or LocationT1218.005 Mshta
- Vendors
- OpenAI
- Products
- OpenAI API
- Organizations
- Cisco Talos
- AI models
- gpt-4
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | total-sitevv.lol | ion IP address 87.120.196[.]120 Active NIK C2 server Domain total-sitevv[.]lol Resolves to the C2 server TLS certificate CN nik-panel Ma |
| ipv4 | 87.120.196.120 | f compromise (IoCs):- Type Indicator Description IP address 87.120.196[.]120 Active NIK C2 server Domain total-sitevv[.]lol Resolves t |
| sha1 | 7d16381a9de823943b5a0987dbd0f26edf22052b | nik-panel Matches strings in the implant Certificate serial 7d16381a9de823943b5a0987dbd0f26edf22052b C2 server certificate JARM 28d28d28d00000000042d42d0000001f |
| sha256 | 4887afc0a574e9419a9695ef083460f58e4ef9a1c40793523ce112251273bdf9 | 9c5632ea347780992006f91c5295 Hardcoded decoded seed AES key 4887AFC0A574E9419A9695EF083460F58E4EF9A1C40793523CE112251273BDF9 32-byte traffic key Build path /opt/nik_panel/data/build_52 |
| sha256 | d791dd0ff3228ed29a8d7333d4567be829159c5632ea347780992006f91c5295 | f80ed39a1e352adeb016a07b C2 server TLS fingerprint AES seed d791dd0ff3228ed29a8d7333d4567be829159c5632ea347780992006f91c5295 Hardcoded decoded seed AES key 4887AFC0A574E9419A9695EF0834 |
From the original article
3 min read at cybersecuritynews.com
A new malware framework called NIK C2 is turning the OpenAI API into a tool for cybercriminals. Its Windows implant can dump passwords, record every keystroke, take hidden control of a desktop, and send the stolen data to an AI model for analysis, all inside the same session. The tool is a Go-based, 64-bit Windows […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.