New x47.c Botnet Targets AI Services with API Draining Attacks

• •x47.c botnet offers 18 attack methods, including AI credit draining.
• •Attackers can exploit valid API keys to execute denial-of-wallet attacks.
• •Qrator Labs recommends revoking exposed keys and monitoring billing.

A new Windows botnet, x47.c, has been discovered offering 18 attack methods, including a feature to drain AI credits from victims' accounts. This botnet, sold by a seller known as WraithTools, allows attackers to exploit valid API keys for services like OpenAI and xAI, executing a denial-of-wallet (DoW) attack. The botnet's capabilities include credential theft, SOCKS5 proxying, and various DDoS techniques. The AI API drain method sends repeated billable requests directly to the provider, bypassing the victim's application and keeping their website operational while exhausting AI credits. The total cost incurred by victims depends on their initial balance and any automatic top-up settings. Qrator Research Labs advises affected users to revoke exposed API keys, monitor their billing, and implement spending limits. The botnet is currently active and poses a significant threat to organizations using AI services.