NIK C2 malware abuses OpenAI API for credential theft and remote control
MALWAREChromeredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A new malware framework called NIK C2 infects Windows computers to steal passwords, record keystrokes and take hidden control of the desktop. It can also send stolen data to an AI model to help the attacker analyse it. Researchers say it can bill the victim's own OpenAI account, which hides who is behind it.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Hunt for the listed NIK C2 indicators of compromise, including the C2 IP address, domain, certificate and API endpoints, across logs and endpoints.
- Scan endpoints for the ClamAV signature Win.Trojan.GoDiscorder-10060526-0.
- Check for the SystemLock Run key and the dropped files lockscreen.html, lockstart.bat and browserdata.zip in the temp folder.
- Review systems for unexpected use of the OPENAIAPIKEY environment variable, since the implant falls back to it.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Companies