WraithTools Sells x47.c Botnet With AI Credit Drain

Qrator says WraithTools sells the x47.c Windows botnet with AI API credit draining and a Grok persistence module.

Qrator Research Labs has documented a Windows botnet called x47.c sold by threat actor WraithTools. It is advertised with DDoS, SOCKS5 proxying, browser credential theft, fast-flux control, and an AI API drain that spends OpenAI or xAI credits through repeated billable requests using a supplied key. An AI Stealth module is said to call xAI's Grok to pick persistence and evasion actions, such as startup entries, scheduled tasks, and Defender exclusions, with local fallbacks if the model call fails. Sources differ on the count of 18: Infosecurity describes 18 attack methods, while SecurityWeek says the panel lists 18 DDoS methods and treats the AI drain as one of those modes. Early August pricing was reported as a $200 base kit, a $150 DDoS add-on, and a $950 full package, in line with a $200 to $950 range.

• Qrator Research Labs documented the Windows botnet x47.c, sold by WraithTools.
• Infosecurity describes 18 attack methods; SecurityWeek says the panel lists 18 DDoS methods and includes AI API credit draining among them.
• The AI drain spends OpenAI or xAI credits by sending repeated billable requests with a supplied API key.
• An AI Stealth module calls xAI Grok to choose persistence and evasion actions, including startup entries, scheduled tasks, and Defender exclusions, with local fallbacks if the model call fails.
• Also advertised: SOCKS5 proxying, fast-flux control, and theft of browser passwords, cookies, Discord tokens, and wallet data.
• Early August pricing was a $200 base kit, a $150 DDoS add-on, and a $950 full package.