534/69 Monday, September 28, 2026
Qrator Research Labs has disclosed the discovery of x47.c, a Windows botnet being advertised with multiple capabilities, including DDoS attacks, credential theft, SOCKS5 proxy creation, and an AI API Drain feature designed to consume credits or generate charges on AI service accounts. The botnet also includes an AI Stealth module that uses xAI Grok to assess the state of an infected machine and select a persistence method from predefined options, such as startup entries and scheduled tasks. Many of these capabilities are based on documentation and claims published by the seller, and their effectiveness in real-world attacks has not yet been fully verified.
The AI API Drain attack requires a valid API key belonging to the target account. Attackers can then select a model and send large volumes of requests to OpenAI, xAI, or services that support compatible API formats, directly consuming credits or increasing charges on the account. The AI Stealth module is designed to use Grok to help select a method for maintaining malware persistence on infected machines and includes fallback mechanisms if AI services cannot be accessed. x47.c is also advertised as being capable of stealing browser passwords and cookies, Discord tokens, cryptocurrency wallet data, and tokens associated with AI services.
Administrators should deploy malware protection on Windows devices and monitor for suspicious activity such as unauthorized startup entries, scheduled tasks, or changes to Windows Defender exclusions. Organizations using AI services through APIs should securely protect API keys, monitor abnormal usage and billing activity, set spending limits, control automatic credit top-ups, and immediately revoke or rotate keys if exposure is suspected. Because AI API Drain attacks can send requests directly to AI service providers, compromised credentials could result in depleted credits or unexpected additional charges.
Source: https://www.securityweek.com/new-x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/