Researchers say a new Windows botnet called x47.c is being sold to criminals and can steal passwords, turn infected computers into proxies, launch denial-of-service attacks, and run up charges on victims’ artificial-intelligence accounts. Qrator says the malware includes an 'AI stealth' persistence module that uses xAI Grok to choose from predefined host-maintenance actions such as startup entries, scheduled tasks, and Windows Defender exclusions, plus an 'AI API drain' mode that uses valid OpenAI, xAI, and compatible API keys to consume paid credits directly at the provider.
Why it matters: This is not just another botnet: it can both compromise Windows systems and create direct financial damage by exhausting paid AI service credits. Organizations using OpenAI- or xAI-linked applications should treat exposed API keys and infected Windows endpoints as urgent risks, rotate keys, review billing and usage logs, and investigate signs of infostealer activity.
Ionut Arghire
2026.09.26
100% relevant
This article establishes a distinct threat event: the first reporting here centers on the x47.c botnet itself, its sale by WraithTools, and its specific use of xAI Grok for persistence plus AI API credit-draining functionality.
← Back to all stories