Cisco Talos finds NIK C2 Windows RAT abusing OpenAI API

Cisco Talos has identified NIK C2, a Go-written Windows RAT with active command-and-control infrastructure. It can hijack RDP sessions, steal credentials and crypto wallets, patch AMSI, and send prompts to the OpenAI API, and it can lock the victim's screen.

• Primary channel is TLS WebSocket on port 443, falling back to HTTP polling every 250 ms
• Capabilities include credential dumping, keylogging, RDP hijacking, process hollowing, AMSI and UAC bypass
• The ai_generate command sends prompts to the OpenAI API, using a key from the victim's OPENAI_API_KEY
• Talos assesses NIK C2 as a functional framework rather than a PoC; samples seen in the wild