NIK C2 Malware Makes Victims Pay for Its Own AI Attacks, Cisco Talos Warns

Cisco Talos has exposed a new Windows malware framework called NIK C2 that turns a victim's own artificial intelligence subscription against them, running OpenAI queries on stolen API keys so the people it infects end up paying for the attack on their own machines. Reported on October 29, 2026, the discovery adds an unsettling twist to AI-powered crimeware: the malware does not merely steal data, it quietly bills the victim for the computing used to analyse that data. Researchers say the tool is already fully functional.

NIK C2 is a Go-based, 64-bit Windows implant with an integrated OpenAI client. Its ai_generate command lets an operator supply a prompt and choose a model. With no attacker key provided, it reads the victim's own OPENAI_API_KEY instead — a fallback Talos called deliberate: the victim pays, and logs point to the victim's key, leaving no trace of the attacker.

Key Points

• Cisco Talos reported NIK C2 on October 29, 2026, a Go-based Windows implant with a built-in OpenAI client that analyses stolen data on the infected machine.
• Its ai_generate command runs operator prompts through a chosen model — and with no attacker key supplied, it bills the victim's own OPENAI_API_KEY.
• Over 52 commands cover credential theft, crypto wallets and seed phrases, keylogging, screen capture, camera and microphone recording, and remote access.
• A screen-locking ransomware module demands Bitcoin or Tether but encrypts nothing; the implant poses as csrss.exe and marks itself critical, so killing it triggers a Blue Screen of Death.
• Three versions evolved between August 12 and 18, 2026; ClamAV detects it as Win.Trojan.GoDiscorder-10060526-0.

What Happened

Talos said it observed NIK C2 in the wild and published its findings on October 29, 2026. The framework is unusual because it does most of its analytical work inside the compromised session, not by exfiltrating data for offline processing. Through ai_generate, an operator supplies a prompt and picks a model, and the implant's OpenAI client answers on the victim's machine.

The billing trick sets NIK C2 apart from conventional infostealers. If the operator supplies no API key, the implant reaches for the victim's key, so the victim's account pays and the access logs show the victim's key rather than the attacker's. Talos assessed this as deliberate — a way to shift both the cost and the forensic trail onto the person being attacked.

Researchers found at least three versions evolving from August 12 to 18, 2026, suggesting active development. Live infrastructure was still active during the research, including server IP 87.120.196.120 and domain total-sitevv.lol. Talos assessed with moderate confidence that NIK C2 is fully functional, not a proof of concept.

How NIK C2 Malware Works

Once installed, the implant renames itself csrss.exe, mimicking a legitimate Windows system process, and marks itself critical. Terminating a critical process forces Windows to crash with a Blue Screen of Death, so a victim who spots the process and tries to kill it can crash their own machine instead.

Its command set is broad: credential and browser-data theft, cryptocurrency wallets and seed phrases, Wi-Fi credentials, keylogging, screen capture, camera and microphone recording, and remote access. Beside all that sits a screen-locking ransomware module demanding Bitcoin or Tether (USDT) that encrypts nothing. Victims who pay are paying to unlock a screen, not to recover data.

The AI capability is a force multiplier. Rather than sifting through stolen data by hand, an operator can ask a model to summarise, search or triage the haul in place, keeping sensitive material on the victim's machine until the attacker decides what is worth taking. That reduces network traffic and the chance of detection — legitimate enterprise AI logic, which reached $176.8 billion in spending in 2026 per Menlo Ventures, turned to criminal use.

Reactions and Defender Guidance

Talos's central advice is practical: watch for unexpected calls to api.openai.com from ordinary endpoints. A workstation with no reason to contact OpenAI's API is a red flag, possibly the only visible sign of infection. Anyone suspecting exposure should rotate any AI key on the machine, since a stolen key can be reused after the implant is gone.

The discovery lands as the industry races to secure AI agents: CrowdStrike announced on Tuesday it is buying AI security startups Fiddler AI and Dreadnode in a deal reported at about $495 million. NIK C2 shows the other side of that coin — attackers using agents as a weapon. Anyone leaving API keys in environment variables on everyday machines should scope keys narrowly, set spending limits, and monitor for unfamiliar queries.

Why It Matters

NIK C2 matters for three reasons. First, it erases the line between infostealer and AI tooling: it rents intelligence on the victim's dime to make sense of stolen data faster. Second, its billing trick complicates attribution — when logs point to the victim, investigators must separate attacker activity from legitimate use. Third, it arrives as AI keys proliferate: as coding assistants and agents become standard, more machines carry a live, funded key, each a potential funding source.

The framework also shows how fast criminal tooling absorbs new technology: three versions in one August week, in the wild within months. Defenders who still treat malware as purely data theft must add API monitoring and key hygiene to their playbook.

What Happens Next

Talos's disclosure, with ClamAV detection available, should help identify existing infections, and the exposed server IP and domain give network teams indicators to block. But the rapid August evolution suggests active development, and later versions may change infrastructure or refine the AI feature. Researchers will watch for copycats adopting the victim-pays model.

For organisations, the immediate steps are clear: audit which machines hold AI API keys, restrict them to minimum permissions and spending caps, monitor for unexpected calls to AI provider APIs, and treat any unexplained OpenAI usage spike as a potential incident. For individuals, never leave a funded API key in an environment variable on a general-purpose machine, and check usage dashboards for queries you did not make.

Frequently Asked Questions

What is NIK C2 malware?

A Go-based Windows framework reported by Cisco Talos on October 29, 2026, combining data theft, remote access and a fake ransomware module with a built-in OpenAI client.

How does NIK C2 make victims pay for its own AI?

Its ai_generate command runs prompts through OpenAI's API. With no attacker key supplied, the implant reads the victim's own OPENAI_API_KEY, so the victim's payment method is charged and logs show the victim's key.

What data does NIK C2 steal?

Over 52 commands cover credentials, browser data, crypto wallets and seed phrases, Wi-Fi credentials, keylogging, screen capture, and camera and microphone recording, plus remote access.

Does its ransomware module encrypt files?

No. The screen-locking module demands Bitcoin or Tether but encrypts no files — victims pay to unlock the screen, not to recover data.

How can I tell if a machine is infected?

Watch for unexpected api.openai.com calls from ordinary endpoints and rotate any exposed key. ClamAV detects it as Win.Trojan.GoDiscorder-10060526-0; it may appear as csrss.exe, which crashes the machine if killed.

Related: CrowdStrike buys Fiddler AI and Dreadnode, enterprise AI spending at $176.8 billion, NYT sues Brave over AI paywall bypass.