NIK C2 can use victims’ OpenAI keys for AI queries

Talos says operators can route arbitrary prompts to the OpenAI Chat Completions API through an infected host.[1] If the operator does not provide an API key, the implant can use the victim’s OPENAI_API_KEY environment variable.[1] Talos says OpenAI’s billing system would charge the victim’s payment method for requests made with that key, while OpenAI’s access logs would identify the victim’s key and leave no trace attributable to the attacker.[1] For incident responders, the report makes API credentials and billing activity relevant to an endpoint investigation, not just the infected device.

Talos describes NIK C2 as a Go-based, 64-bit Windows remote access tool that supports more than 52 commands.[1] Its capabilities include stealing browser data, saved passwords, cookies, autofill data, cryptocurrency wallets, Discord tokens and Firefox profiles, as well as Wi-Fi network names and plaintext passwords.[1] The implant can also support camera and audio surveillance, RDP session interaction for lateral movement, and a screen-locking module that displays Bitcoin or USDT demands.[1] Talos says that module does not encrypt files.[1]

The implant uses TLS-secured WebSockets on port 443, with HTTP polling every 250 milliseconds as a fallback, and encrypts traffic using AES-256-GCM with a hardcoded seed.[1] Talos says it routes traffic across three prioritized command-and-control tiers.[1] The AI request runs synchronously with a 60-second timeout and can analyze harvested data within the compromised session.[1] GPT-4 is the default model when the operator does not specify one, but an operator can choose any valid OpenAI model identifier.[1]

Talos observed at least three distinct versions of the implant and active NIK C2 infrastructure in the wild; it assessed with moderate confidence that the framework was functional rather than a proof of concept.[1] The report says the framework combines data collection and exploitation in one continuous session, removing offline-processing delays that could give defenders time to detect activity.[1] Talos recommends moving beyond traditional detection toward continuous behavioral vigilance.[1] The report’s findings support reviewing how teams monitor endpoint behavior and handle potentially exposed API credentials.