Cisco Talos observed a command-and-control framework called NIK C2 in the wild, according to research published October 29. The framework includes a Go-based implant that gives attackers remote access, credential theft, keylogging and surveillance capabilities.
The implant includes an integrated OpenAI client. Talos said attackers can supply a prompt and model choice through the C2 panel. The implant then sends the request to OpenAI from the victim's machine and returns the response to the operator.
If the operator provides no key, the malware reads an OPENAI_API_KEY environment variable on the infected machine. Talos called this a deliberate design. Talos said OpenAI's billing would charge the victim's payment method, and access logs would show the victim's key as the requester.
Talos said the Windows malware supports more than 52 commands. These cover credential theft, browser data collection, cryptocurrency wallets, Wi-Fi credentials, keylogging, screen capture and remote access. Talos also said it offers lateral movement and multiple defense-evasion capabilities.
The framework includes a screen-locking ransomware module that displays ransom demands in Bitcoin or the Tether stablecoin (USDT). Talos said the module encrypts no files.