NIK C2: malware that calls the OpenAI API with the victim's own key

01What happened

Cisco Talos published its analysis of NIK C2 on October 29, 2026, after observing the framework in the wild. Researcher Chetan Raghuprasad identified at least three distinct versions of the Go-based 64-bit Windows implant, all compiled with Go 1.23.4. Talos assesses with moderate confidence that NIK C2 is a fully functional framework and not a proof of concept.

02How it works

The implant's ai_generate command reads three fields from the command-and-control payload: prompt, api_key and model. It then posts to api.openai.com/v1/chat/completions from the victim machine, pairing a 68-byte hardcoded system message with the operator's prompt and waiting up to 60 seconds for a reply. When the operator supplies no key, the implant falls back to the victim's OPENAI_API_KEY environment variable, so the victim's account pays for the request and the victim's key appears in OpenAI's logs. Talos decoded gpt-4 as the model used when none is named.

03Who is affected

Windows hosts are the target. Saved credentials are taken from Chrome, Edge, Brave, Opera and Firefox, decrypted locally with DPAPI or exfiltrated as raw databases, alongside Wi-Fi passwords collected through netsh, Discord tokens, cookies and crypto wallet files. Any compromised host that keeps an OPENAI_API_KEY in its environment also hands the operator inference on the victim's account.

04What to do

Alert on requests to api.openai.com from Windows binaries that have no reason to make them, and treat a 250 millisecond HTTP polling pattern to an unknown host on port 443 as suspicious. Block the indicators Talos published and deploy its ClamAV signature. Rotate any OPENAI_API_KEY held in the environment of a host you suspect.

Questions people ask

Does NIK C2 use the victim's own OpenAI API key?

NIK C2 reads the OPENAI_API_KEY environment variable on the compromised Windows host whenever the operator does not supply a key, according to Cisco Talos. The victim's account is then billed for the operator's requests, and the victim's key appears in OpenAI's own logs. Rotating that key belongs in the cleanup for any host where the implant ran.

Is NIK C2 a proof of concept or working malware?

Cisco Talos assesses with moderate confidence that NIK C2 is a fully functional AI-integrated command-and-control framework rather than a proof of concept. Talos found at least three distinct versions of the implant and says the pace of development points to a technically proficient team with earlier malware experience. Talos observed the framework in the wild.

How can defenders detect NIK C2 on a Windows host?

Cisco Talos published a ClamAV signature, Win.Trojan.GoDiscorder-10060526-0, and 18 indicators covering eight file hashes, one domain, two IP addresses and six command-and-control URL paths. Behavioral signals in the Talos analysis include a 250 millisecond HTTP polling interval, TLS WebSocket traffic on port 443, and a registry Run key named SystemLock left by the screen-locker module.

Does the ransomware module encrypt files?

The NIK C2 ransomware module is a screen locker, not a file encryptor, Cisco Talos reports. It backs up the master boot record to mbr_backup.bin, writes lock_screen.html and displays it through mshta.exe, then keeps the lock screen alive with a goroutine that relaunches it every five seconds. Ransom demands are made in Bitcoin or USDT.

Sources 2 links, all fetched

1. 1blog.talosintelligence.comTalos Analysis
2. 2github.comTalos IOCs