Back Scworld

New Windows botnet offers AI credit draining and other attack methods | brief

Scworld • September 24, 2026

As detailed in Infosecurity Magazine, a newly identified Windows botnet named x47.c has emerged, offering a wide array of 18 distinct attack methods, notably including a feature designed to deplete victims' paid AI credits.

The botnet, sold by WraithTools, includes capabilities for credential theft, SOCKS5 proxying, and an AI module for malware persistence, Qrator Research Labs reports. A significant feature is the "AI API drain" command, which exploits valid API keys for services like OpenAI and xAI. This attack, termed denial of wallet (DoW) by OWASP, repeatedly sends billable requests directly to the AI provider, bypassing the victim's application and leaving their website functional while draining AI credits. The seller promotes this method against chatbots, AI-integrated content management systems, and trading bots, suggesting its use against competitors and highlighting automatic top-ups as a way to sustain charges.

Other attack vectors include various DDoS methods like HTTP floods and UDP floods, alongside an "AI Stealth" module that uses AI to assess infected hosts and implement concealment actions. Qrator Research Labs advises users to revoke exposed AI keys, monitor billing, set spending limits, and implement endpoint security and layered DDoS protection.

Source: Infosecurity Magazine

SC Staff September 22, 2026

SC Staff September 21, 2026

Get daily

You can skip this ad in 5 seconds

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New x47.c Botnet Targets AI Services with API Draining Attacks A new Windows botnet, x47.c, has been discovered offering 18 attack methods, including a feature to drain AI credits from victims' accounts. This botnet, sold by a seller known as WraithTools, allows attackers to exploit valid API keys for services like OpenAI and xAI, executing a denial-of-wallet (DoW) attack. The botnet's capabilities include credential theft, SOCKS5 proxying, and various DDoS techniques. The AI API drain method sends repeated billable requests directly to the provider, bypassing the victim's application and keeping their website operational while exhausting AI credits. The total cost incurred by victims depends on their initial balance and any automatic top-up settings. Qrator Research Labs advises affected users to revoke exposed API keys, monitor their billing, and implement spending limits. The botnet is currently active and poses a significant threat to organizations using AI services. 4 sources 66

Extracted Entities

New Windows botnet offers AI credit draining and other attack methods | brief

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)