Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Cisco Talos details in-the-wild NIK C2 that bills victims’ OpenAI keys

4 sources · 5 articlesFirst reported Updated ()1
What's new

October 30: Cyber Security News adds Talos’s moderate-confidence assessment, Discord-token theft, an MBR backup that does not encrypt files, and roughly 250-millisecond HTTP check-ins.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Talos says the NIK C2 Go implant steals data, locks screens without encrypting files, and can bill a victim’s OpenAI key.

Cisco Talos says it observed NIK C2 in the wild: a 64-bit Windows command-and-control implant written in Go 1.23.4, with at least three versions and more than 52 commands. Dual-channel control uses TLS WebSockets on port 443 and HTTP polling about every 250 milliseconds, with AES-256-GCM traffic. Operators can steal credentials, browser, wallet, Wi-Fi and Discord data, log keystrokes, capture screens, hijack RDP and hollow processes. An ai_generate command calls OpenAI Chat Completions from the host, falling back to OPENAI_API_KEY and defaulting to gpt-4, so the victim is billed. A lock-screen module demands Bitcoin or USDT, relaunches via mshta.exe, and does not encrypt files; Talos links live infrastructure to 87.120.196.120 and total-sitevv.lol.

Key facts
  • Built with Go 1.23.4; Talos saw at least three versions and more than 52 commands.
  • C2: TLS WebSockets on 443 and HTTP checks about every 250 ms, AES-256-GCM.
  • ai_generate uses the victim’s OPENAI_API_KEY and defaults to gpt-4.
  • Lock screen demands Bitcoin or USDT and does not encrypt files.
  • Live indicators include 87.120.196.120 and total-sitevv.lol; ClamAV signature published.
  • Cyber Security News says Talos rates it a working framework with moderate confidence.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026Cisco Talos publishes its NIK C2 analysis. · Infosecurity Magazine

What each outlet adds

beyond the shared facts
  • Cisco TalosGo 1.23.4, C2 fallback tiers, nik-panel certificate, and live infrastructure.
  • Infosecurity MagazineMore than 52 commands; OpenAI logs show the victim’s key.
  • GBHackers250 ms polling, mshta relaunch, ClamAV name, and bootkit.bin placeholder.
  • Cyber Security NewsModerate confidence, Discord tokens, and MBR backup without encryption.
Vendors
OpenAICisco
Products
OpenAI APIClamAV
Malware
NIK C2SesameOp
Organizations
Cisco TalosOpenAI
AI models
gpt-4

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Cisco TalosFirst report

    Talos details NIK C2, an AI-enabled Windows implant seen live

    Operators can dump credentials, log keystrokes, call OpenAI from the host, and deploy screen-lock ransomware.

  2. · 1d ago Infosecurity Magazine

    NIK C2 malware bills AI queries to victims' OpenAI keys

    Cisco Talos says the Go implant offers more than 52 commands plus a screen-lock ransom module that encrypts no files.

  3. · 1d ago Cisco Talos

    Talos finds NIK C2 Windows implant that spends victims' OpenAI keys

    The Go implant dumps credentials, captures keystrokes, and can lock screens with ransomware while calling an OpenAI model on the host.

  4. · 12h ago GBHackers

    Talos finds NIK C2 Windows RAT that calls OpenAI from infected PCs

    The Go implant runs more than 52 commands, bills the victim’s OpenAI key, and shows a lock screen without encrypting files.

  5. · 9h ago Cyber Security News

    NIK C2 malware uses the OpenAI API for theft and remote control

    Cisco Talos says the Go implant can bill a victim’s OpenAI key, log keys, and show a non-encrypting lock screen.