Hackers Weaponize OpenAI API in NIK C2 Framework for Credential Theft and Remote System Control

A new malware framework called NIK C2 is turning the OpenAI API into a tool for cybercriminals. Its Windows implant can dump passwords, record every keystroke, take hidden control of a desktop, and send the stolen data to an AI model for analysis, all inside the same session.

The tool is a Go-based, 64-bit Windows remote access program. It talks to its server over TLS-secured WebSockets on port 443.

It also uses an HTTP backup channel that checks in about every 250 milliseconds. All traffic is locked with AES-256-GCM encryption, and the implant rotates between three server tiers so a single takedown does not cut it off.

Researchers at Cisco Talos identified the malware and published their findings on October 29, 2026. Talos found a live server in the wild and said, with moderate confidence, that NIK C2 is a working framework and not a proof of concept.

The samples point to at least three versions, which suggests a skilled team that keeps adding features. Abusing OpenAI is not new.

The earlier OpenAI Assistants API backdoor called SesameOp used the service to hide its command traffic. NIK C2 goes a step further by using the model as a built-in analyst.

Hackers Weaponize OpenAI API

The AI feature runs through a command named ai_generate. The operator sends a prompt, an API key, and a model name.

The implant builds a request and sends it to the OpenAI Chat Completions endpoint from the victim’s computer. It waits up to 60 seconds, reads the answer, and returns the text to the attacker’s panel along with token-usage counts. If no model is named, it defaults to gpt-4.

The most worrying detail is the key fallback. If the attacker leaves out an API key, the implant reads the OPENAI_API_KEY variable on the victim’s machine.

OpenAI then bills the victim, and the logs show the victim’s key, so nothing points back to the attacker. Talos calls this a deliberate design choice. This kind of AI-enabled malware is getting more attention from defenders.

Talos has also released the open-source CAIRN toolkit, which hunts for AI endpoints, prompt templates, and API-key patterns inside suspicious files. Because normal apps use the same AI services, blocking those domains alone is not practical.

Credential Theft, Remote Control, and Screen-Locking Ransomware

The implant supports more than 52 commands. For theft, it copies browser databases from Chrome, Edge, Brave, Opera, and Firefox. It also grabs saved Wi-Fi passwords, Discord tokens, and desktop crypto wallets such as Exodus, Electrum, and Bitcoin Core.

It also targets wallet extensions such as MetaMask, Coinbase Wallet, and Phantom. Two search patterns hunt the whole disk for files with names like “seed,” “mnemonic,” “private,” or “secret.”

A keylogger streams each keystroke live to the attacker. Hidden VNC gives full desktop control that the victim cannot see. The implant also offers proxy tunnels and RDP session control to move deeper into a network.

To stay hidden, the implant renames itself to names like svchost.exe and csrss.exe and patches AMSI so PowerShell scripts are not scanned.

It also skips the UAC prompt with a fodhelper trick. It marks itself as a critical process, so ending it in Task Manager triggers a Blue Screen of Death.

The ransomware module is simple but fast. It backs up the Master Boot Record, writes an HTML lock screen with the attacker’s Bitcoin or USDT wallet details, and opens it through the Windows mshta.exe utility, a trusted tool that attackers often misuse.

A registry Run key named “SystemLock” brings the screen back after every restart. It does not encrypt files, so it leaves little forensic evidence. A separate bootkit-prep feature checks UEFI, BIOS, and Secure Boot status.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Weaponize OpenAI API in NIK C2 Framework for Credential Theft and Remote System Control appeared first on Cyber Security News.