New NIK C2 Malware Makes Victims Pay for Its AI by Billing Their Own OpenAI Keys While It Steals Everything

A new malware framework has found a neat way to cover its AI bill: it sends the invoice to the person it is robbing. NIK C2, a Windows implant written in Go, has an OpenAI client built in, and when its operator supplies no API key, it simply reads the one on the victim's machine.

Cisco Talos published the research on 29 October after seeing the malware in the wild. It found at least three versions of the implant, with infrastructure active during the research, and has moderate confidence that this is a fully functional framework and not a proof of concept.

The victim picks up the tab

The operator types a prompt and picks a model in the command panel. The implant sends the request to OpenAI from the infected computer and returns the answer. The ai_generate command takes a prompt, an optional key and an optional model, and with no key supplied it falls back to the OPENAI_API_KEY environment variable, a choice Talos called deliberate.

The trick pays twice. OpenAI billing charges the victim's payment method, and the access logs show the victim's key, leaving nothing that points at the attacker. Stolen AI access can get expensive fast, as METR found when attackers burned through about $600,000 in donated credits with a single stolen key.

Talos argues the bigger shift is speed. NIK C2 reshapes adversary tradecraft "by collapsing collection and exploitation into a single continuous session, effectively erasing the offline processing delays that historically granted defenders critical detection windows." In plainer terms, an attacker can ask a model about stolen data while still inside the machine that held it.

Everything else it takes

The AI is the novelty, but the theft and surveillance menu runs to more than 52 commands. It grabs browser credentials, Discord tokens, Wi-Fi passwords, crypto wallets and seed-phrase files. It logs keystrokes, captures the screen, records from the camera and microphone, and watches the clipboard. Hidden VNC, proxies, RDP and lateral movement let the operator keep going, while registry Run keys and a watchdog process keep it installed.

It is hard to dislodge, too. The implant renames itself csrss.exe and marks itself a critical process, so killing it triggers a Blue Screen of Death. It exits silently under a debugger, bypasses UAC by hijacking fodhelper.exe, and patches AMSI in PowerShell. Traffic runs over TLS WebSockets on port 443 and falls back to HTTP polling every 250 milliseconds, with three tiers of command servers in case one goes dark.

Ransomware that encrypts nothing

The ransomware module is mostly theater. It backs up the Master Boot Record, then uses mshta.exe to show an HTML lock screen demanding Bitcoin and USDT. Close it, and a batch loop brings it back within five seconds.

No files are encrypted, so there are no file-modification timestamps or encryption markers to find, and a screen lock is far quicker to deploy than real ransomware. A separate routine checks UEFI or BIOS and Secure Boot state and writes a placeholder file called bootkit.bin.

NIK C2 joins a growing line of LLM-enabled malware such as MalTerminal.

Defenders can look for the live server at 87.120.196[.]120 and the domain total-sitevv[.]lol, whose certificate carries the common name "nik-panel", along with the SystemLock Run key and lock_start.bat or lock_screen.html in the temp directory. Unexpected calls to api.openai.com from ordinary endpoints are a strong clue, and any exposed AI key should be rotated. ClamAV detects the malware as Win.Trojan.GoDiscorder-10060526-0, though Talos says frameworks like this one demand continuous behavioral monitoring.

Some offers on this page may be paid placements or contain affiliate links.