NIK C2 malware bills AI queries to victims' OpenAI keys
Original title: NIK C2 Malware Can Use Victims’ OpenAI Keys for AI Queries
Cisco Talos says the Go implant offers more than 52 commands plus a screen-lock ransom module that encrypts no files.
Cisco Talos reported NIK C2, a Go-based Windows command-and-control implant observed in the wild and published on October 29. Operators can send prompts and a model choice from the C2 panel; the implant calls OpenAI from the victim machine. If no key is supplied, it reads the OPENAI_API_KEY environment variable, so the victim’s account is billed and logs show the victim’s key. The framework also steals credentials and browser, wallet and Wi-Fi data, and includes keylogging, screen capture, remote access and a screen-locking ransom note demanding Bitcoin or USDT.
Unconfirmed: Talos assesses with moderate confidence that NIK C2 is fully functional rather than a proof of concept.
- Talos saw at least three implant versions and active infrastructure.
- The ransom module locks the screen and does not encrypt files.
- OpenAI access logs would attribute requests to the victim’s key.
- Talos says collection and AI analysis happen in one session.
Impact: Remote access, stolen credentials and victim-funded OpenAI queries
| Product | Affected |
|---|---|
| OpenAI API | — |
- 1.Check compromised Windows hosts for an OPENAI_API_KEY environment variable.
- 2.Review OpenAI billing and access logs for unexpected API use.
- Vendors
- OpenAI
- Malware
- NIK C2
- Organizations
- Cisco Talos
From the original article
2 min read at infosecurity-magazine.com
NIK C2 malware can fall back on victims’ OpenAI API keys to run AI queries
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.