New AI-Powered NIK C2 Malware Uses OpenAI API to Help Hackers Steal Data and Control Windows PCs

Cisco Talos has uncovered NIK C2, a Go-based, 64-bit Windows remote access tool that embeds a working OpenAI client.

Operators can send prompts through an infected machine and read the model’s replies in their C2 panel.

NIK C2 malware

According to technical research published by Cisco Talos, the implant talks to its server over TLS-secured WebSockets on port 443. It also runs an HTTP fallback loop that polls every 250 milliseconds.

All traffic uses AES-256-GCM with a key derived from a hardcoded seed. Three prioritized C2 tiers help it survive takedowns: runtime-updated URLs, an embedded encrypted server list and a hardcoded fallback address.

Talos saw a live server at 87.120.196[.]120, which resolved to total-sitevv[.]lol. Its certificate used the common name “nik-panel”. That convinced researchers, with moderate confidence, that this is a functional framework and not a proof of concept.

The ai_generate command takes a prompt, an optional API key and an optional model name. If the operator supplies no key, the implant reads the victim’s OPENAI_API_KEY environment variable.

The victim’s account then pays for the inference, and OpenAI’s logs point to the victim, not the attacker. The default model is gpt-4. Requests go to the Chat Completions endpoint with a 60-second timeout.

This fits a growing pattern of LLM-enabled malware such as MalTerminal and AI-driven botnets like x47.c.

The dispatcher handles more than 52 commands. They cover theft of browser credentials, Discord tokens, Wi-Fi passwords, crypto wallets and seed-phrase files, surveillance via a keylogger, screen capture, camera and audio, and clipboard monitoring, remote control and lateral movement through hidden VNC, SOCKS5 and reverse proxies, and RDP operations, as well as persistence using registry Run keys and a watchdog process.

The ransomware module backs up the Master Boot Record. It then builds an HTML lock screen with Bitcoin and USDT demands and launches it through mshta.exe. A batch loop reopens the screen within five seconds if the user closes it. The module encrypts no files.

A separate bootkit-preparation routine checks for UEFI or BIOS and the Secure Boot state. It then writes a placeholder file named “bootkit.bin”.

The implant renames itself to csrss.exe, marks itself as a critical process so terminating it triggers a Blue Screen of Death, exits silently when it detects a debugger, bypasses UAC through a fodhelper.exe hijack, and patches AMSI in PowerShell.

ClamAV detects the threat as Win.Trojan.GoDiscorder-10060526-0. Defenders should watch for traffic to the C2 domain and IP above, the SystemLock Run key, lock_start.bat and lock_screen.html in the temp directory, and unexpected outbound calls to api.openai.com from endpoints.

They should also rotate any exposed AI API keys. Talos notes that such frameworks demand continuous behavioral monitoring, since they collapse collection and exploitation into a single session.