CriticalRansomware
Hackers Weaponize OpenAI API in NIK C2 Framework for Credential Theft and Remote System Control
Cyber Security News·Source published ·1 min read
What happened?
A new malware framework called NIK C2 is turning the OpenAI API into a tool for cybercriminals. Its Windows implant can dump passwords, record every keystroke, take hidden control of a desktop, and send the stolen data to an AI model for analysis, all inside the same session. The tool is a Go-based, 64-bit Windows remote access program. It talks to its server over TLS-secured WebSockets on port 443. It also uses an HTTP backup channel that checks in about every 250 milliseconds.
Key details
- The implant communicates with its server over TLS-secured WebSockets on port 443 and uses an HTTP backup channel checking in every 250 milliseconds.
- NIK C2 abuses the OpenAI API by sending prompts and API keys from the victim's machine to the Chat Completions endpoint.
- If no API key is provided, the implant reads the OPENAI_API_KEY environment variable from the victim's machine, billing the victim for usage.
- The implant supports over 52 commands for credential theft, targeting browsers, Wi-Fi passwords, Discord tokens, and cryptocurrency wallets.
- The ransomware module backs up the Master Boot Record and displays a lock screen via mshta.exe, leaving files unencrypted to reduce forensic evidence.
- Cisco Talos published findings on October 29, 2026, and identified a live server in the wild with moderate confidence that NIK C2 is a working framework.
What to look for
- Hardcoded AES seed d791dd0ff3228ed29a8d7333d4567be829159c5632ea347780992006f91c5295 and AES key 4887AFC0A574E9419A9695EF083460F58E4EF9A1C40793523CE112251273BDF9 are indicators.
- Files mbr_backup.bin, lock_screen.html, lock_start.bat, bootkit.bin, browserdata.zip dropped in temp folder are indicators of compromise.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.