New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining
Seller WraithTools offers the x47.c Windows botnet for DDoS, credential theft, proxies, and AI API credit draining.
Qrator reports that seller WraithTools is advertising the x47.c Windows botnet. In early August the base package was $200, a DDoS add-on $150, and the full package $950. Its panel offers 18 DDoS methods, SOCKS5 proxies, browser credential theft, fast-flux control, and an AI drain that spends OpenAI or xAI credits with a supplied key. An advertised AI stealth module calls xAI Grok to pick persistence actions, with local fallbacks if the model call fails.
- WraithTools priced the base kit at $200 and the full package at $950.
- The panel lists 18 DDoS methods, including an AI API credit-drain mode.
- Drain mode spends OpenAI or xAI credits using a supplied API key.
- A Grok module is advertised to set startup entries, tasks, and Defender exclusions.
- The stealer targets browser passwords, cookies, Discord tokens, and wallet data.
- ATT&CK
- T1498.001 Direct Network FloodT1555.003 Credentials from Web BrowsersT1053.005 Scheduled TaskT1055.012 Process HollowingT1568.001 Fast Flux DNS
- Threat actors
- WraithTools
- Malware
- x47.c
- AI models
- Grok
From the original article
2 min read at securityweek.com
The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions. The post New x47. c Windows Botnet Weaponizes xAI Grok, AI API Draining appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.