Security1 hOctober 29, 2026, 22:00

NIK C2 Malware Uses Victims' OpenAI Keys for AI Queries

Cisco Talos found the NIK C2 framework in the wild, with a Go implant that reads the OPENAI_API_KEY environment variable on infected Windows machines when operators supply no key, billing AI requests to the victim. The implant supports over 52 commands, including credential theft and keylogging, plus a screen-locking ransomware module demanding Bitcoin or USDT.

Infosecurity Magazine

Open source

NIK C2 Malware Uses Victims' OpenAI Keys for AI Queries

Implant reads OPENAI_API_KEY on the victim host if the operator provides no key
OpenAI billing and access logs point to the victim, leaving no attacker trace
Over 52 commands: credential, browser, crypto wallet and Wi-Fi theft, keylogging
Ransomware module only locks the screen and encrypts no files

#Cisco#OpenAI#NIKC2

Hackers Exploited Cisco SD-WAN Flaw to Plant Key-Stealing Malware

Security

PoeLLM malware reads its C2 address from a poem

Security

RatHat shifts to malware-as-a-service with three C2 generations in six months

Security

NIK C2 Malware Uses Victims' OpenAI Keys for AI Queries

Hackers Exploited Cisco SD-WAN Flaw to Plant Key-Stealing Malware

PoeLLM malware reads its C2 address from a poem

RatHat shifts to malware-as-a-service with three C2 generations in six months

PamStealer macOS Malware Adds Live C2 Payload Decryption