NIK C2: New AI-Enabled Malware Framework Exploits Victims' OpenAI Keys

• •NIK C2 malware uses victims' OpenAI API keys for AI queries, obscuring the attacker's identity.
• •The implant supports extensive capabilities, including credential theft, keylogging, and ransomware deployment.
• •At least three versions of the NIK C2 implant have been observed, indicating ongoing development and functionality.

Cisco Talos has identified a new command-and-control (C2) framework named NIK C2, which integrates AI capabilities and can exploit victims' OpenAI API keys for unauthorized queries. The Go-based implant allows attackers to gain remote access, steal credentials, log keystrokes, and conduct surveillance on compromised Windows systems. Notably, the malware can utilize the victim's OpenAI API key for AI analysis, charging the usage to the victim while masking the attacker's identity. NIK C2 also features a screen-locking ransomware module that demands payment in Bitcoin or USDT without leaving a trace of file modification. Talos observed at least three versions of the implant in the wild, indicating it is a fully functional framework rather than a proof of concept. The framework reshapes adversary tactics by merging data collection and exploitation into a continuous session, reducing detection opportunities for defenders.