NIK C2 malware abuses OpenAI API for credential theft and remote control
MALWAREChromeredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
NIK C2 is a Go-based Windows remote access implant that communicates over TLS WebSockets on port 443 with an HTTP backup channel, using AES-256-GCM encryption and rotating across three server tiers. Its aigenerate command sends attacker prompts to the OpenAI Chat Completions endpoint from the victim's machine, and if no API key is supplied it falls back to the victim's OPENAIAPIKEY environment variable. Cisco Talos, which published its findings, reports credential and crypto-wallet theft, a keylogger, hidden VNC, and a screen-locking ransomware module that does not encrypt files.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Hunt for the listed NIK C2 indicators of compromise, including the C2 IP address, domain, certificate and API endpoints, across logs and endpoints.
- Scan endpoints for the ClamAV signature Win.Trojan.GoDiscorder-10060526-0.
- Check for the SystemLock Run key and the dropped files lockscreen.html, lockstart.bat and browserdata.zip in the temp folder.
- Review systems for unexpected use of the OPENAIAPIKEY environment variable, since the implant falls back to it.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Companies