# NIK C2: malware that calls the OpenAI API with the victim's own key

> NIK C2 is an AI-integrated command-and-control framework whose Windows implant queries OpenAI models from the machine it has compromised.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Incident, Attack
- **Published by:** Cisco Talos
- **Disclosed:** 2026-10-29
- **Affects:** Windows, OpenAI API, Google Chrome, Microsoft Edge, Mozilla Firefox, Discord
- **Research by:** Chetan Raghuprasad
- **Primary source:** https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/
- **Page:** https://theinjection.dev/items/talos-nik-c2-openai-client/

NIK C2 is a Go-based Windows command-and-control framework, found in the wild by Cisco Talos, whose ai_generate command sends operator prompts to the OpenAI Chat Completions API from the victim host and bills the victim's own key.

## What happened

Cisco Talos published its analysis of NIK C2 on October 29, 2026, after observing the framework in the wild. Researcher Chetan Raghuprasad identified at least three distinct versions of the Go-based 64-bit Windows implant, all compiled with Go 1.23.4. Talos assesses with moderate confidence that NIK C2 is a fully functional framework and not a proof of concept.

## How it works

The implant's ai_generate command reads three fields from the command-and-control payload: prompt, api_key and model. It then posts to api.openai.com/v1/chat/completions from the victim machine, pairing a 68-byte hardcoded system message with the operator's prompt and waiting up to 60 seconds for a reply. When the operator supplies no key, the implant falls back to the victim's OPENAI_API_KEY environment variable, so the victim's account pays for the request and the victim's key appears in OpenAI's logs. Talos decoded gpt-4 as the model used when none is named.

## Who is affected

Windows hosts are the target. Saved credentials are taken from Chrome, Edge, Brave, Opera and Firefox, decrypted locally with DPAPI or exfiltrated as raw databases, alongside Wi-Fi passwords collected through netsh, Discord tokens, cookies and crypto wallet files. Any compromised host that keeps an OPENAI_API_KEY in its environment also hands the operator inference on the victim's account.

## What to do

Alert on requests to api.openai.com from Windows binaries that have no reason to make them, and treat a 250 millisecond HTTP polling pattern to an unknown host on port 443 as suspicious. Block the indicators Talos published and deploy its ClamAV signature. Rotate any OPENAI_API_KEY held in the environment of a host you suspect.

## Quick facts

- **Attack type:** AI-integrated command-and-control framework with a Go-based Windows implant
- **AI call:** ai_generate posts to api.openai.com/v1/chat/completions from the victim host
- **Default model:** gpt-4, decoded from the binary, used when the operator names none
- **Commands:** Over 52, dispatched over TLS WebSockets on port 443 with 250 ms HTTP polling
- **Modules:** Credential theft, keylogger capped at 10,000 entries, screen-locker ransomware, self-heal watchdog
- **Found by:** Chetan Raghuprasad, Cisco Talos
- **Detection:** ClamAV signature Win.Trojan.GoDiscorder-10060526-0, plus 18 published indicators

## Questions

### Does NIK C2 use the victim's own OpenAI API key?

NIK C2 reads the OPENAI_API_KEY environment variable on the compromised Windows host whenever the operator does not supply a key, according to Cisco Talos. The victim's account is then billed for the operator's requests, and the victim's key appears in OpenAI's own logs. Rotating that key belongs in the cleanup for any host where the implant ran.

### Is NIK C2 a proof of concept or working malware?

Cisco Talos assesses with moderate confidence that NIK C2 is a fully functional AI-integrated command-and-control framework rather than a proof of concept. Talos found at least three distinct versions of the implant and says the pace of development points to a technically proficient team with earlier malware experience. Talos observed the framework in the wild.

### How can defenders detect NIK C2 on a Windows host?

Cisco Talos published a ClamAV signature, Win.Trojan.GoDiscorder-10060526-0, and 18 indicators covering eight file hashes, one domain, two IP addresses and six command-and-control URL paths. Behavioral signals in the Talos analysis include a 250 millisecond HTTP polling interval, TLS WebSocket traffic on port 443, and a registry Run key named SystemLock left by the screen-locker module.

### Does the ransomware module encrypt files?

The NIK C2 ransomware module is a screen locker, not a file encryptor, Cisco Talos reports. It backs up the master boot record to mbr_backup.bin, writes lock_screen.html and displays it through mshta.exe, then keeps the lock screen alive with a goroutine that relaunches it every five seconds. Ransom demands are made in Bitcoin or USDT.

## Sources

1. [Talos Analysis](https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/)
2. [Talos IOCs](https://github.com/Cisco-Talos/IOCs/blob/main/2026/10/nik-c2-new-ai-enabled-framework.txt)