x47.c Windows botnet uses xAI Grok for persistence and AI credit draining

Qrator has detailed x47.c, a Windows botnet sold by a threat actor named WraithTools that uses xAI Grok to maintain persistence and an AI API drain mode to burn paid credits on OpenAI and xAI accounts. The base package costs $200, the DDoS add-on $150, and the full bundle $950.

• Full x47.c package is priced at $950, base botnet at $200
• AI stealth module uses xAI Grok to pick startup entries and scheduled tasks
• AI API drain mode consumes paid OpenAI and xAI credits via stolen keys
• C&C panel offers 18 DDoS methods, SOCKS5 proxies and credential theft