A newly discovered hacking toolkit called NIK C2 lets its operators steal passwords, watch keystrokes live and then hand the loot straight to an AI model for analysis, all from inside the victim's own machine. If the victim happens to have an OpenAI API key configured on that computer, the malware can use it, so the victim's account pays for the attacker's AI queries.
Researcher Chetan Raghuprasad of Cisco Talos documented the framework in the original report, after spotting a live NIK C2 server in the wild. Talos assesses with moderate confidence that the tool is a fully functional framework rather than a proof of concept.
An implant that phones ChatGPT for its operator
The NIK C2 implant is a 64-bit Windows remote access tool written in Go. Its ai_generate command takes a prompt, an API key and a model name from the operator, builds a request to OpenAI's Chat Completions API, sends it from the victim's IP address and returns the model's answer, with token usage, to the attacker's panel. The default model hardcoded in the binary is gpt-4, though the operator can name any other model without updating the malware.
The detail that stands out is the fallback. When the operator supplies no key, the implant reads the victim's OPENAI_API_KEY environment variable instead. Talos notes that in that case OpenAI's billing charges the victim's payment method and the access logs show the victim's key, leaving no trace pointing at the attacker.
Talos argues the bigger shift is speed: by analysing stolen data inside the live session, the framework removes the offline processing delay that used to give defenders time to spot an intrusion.
More than 52 commands, from theft to a screen locker
The command dispatcher handles more than 52 commands. Talos lists browser password and cookie theft from Chrome, Edge, Brave, Opera and Firefox, saved Wi-Fi passwords, Discord tokens, desktop and browser-extension crypto wallets, a live keylogger, screen, camera and microphone capture, hidden remote desktop (HVNC), SOCKS5 and reverse-proxy tunnels for moving deeper into a network, and defence evasion including an AMSI patch, UAC bypass and process hollowing.
It can also deploy a screen-locking ransomware page. The module backs up the Master Boot Record, writes an HTML lock screen demanding Bitcoin or USDT, launches it through mshta.exe in a loop that reopens it within five seconds, and adds a registry Run key named SystemLock so it returns at every logon. It does not encrypt files. A separate module checks whether the machine boots via UEFI or BIOS and whether Secure Boot is on, then stages a 16-byte placeholder file reading NIK_BOOTKIT_PREP, which Talos describes as a staging marker rather than an actual bootkit.
Talos tracked at least three versions of the implant, all compiled with Go 1.23.4, and an embedded build path naming the project nik_panel. The pace of new features, Talos says, points to a technically proficient team with prior malware experience.
Hunt for the nik-panel certificate and stray API calls
Talos found the panel on a server whose TLS certificate carried the Common Name nik-panel, matching strings in the implant. Defenders can look for that certificate, for copies of the implant in %AppData%\Roaming\Microsoft\Network masquerading as svchost.exe or simvol.exe, and for unexpected outbound calls to api.openai.com from machines that have no business making them. Anyone storing an OpenAI key in an environment variable on an endpoint should treat it as exposed if that host is compromised, and rotate it.
In August we covered a phishing kit that used AI to check the IDs it stole. NIK C2 moves the same idea inside the victim's network, and onto the victim's bill.
Indicators of compromise
- C2 IP: 87[.]120[.]196[.]120
- C2 domain: total-sitevv[.]lol
- TLS certificate serial: 7d16381a9de823943b5a0987dbd0f26edf22052b (CN nik-panel)
- SHA-256: d791dd0ff3228ed29a8d7333d4567be829159c5632ea347780992006f91c5295
- SHA-256: 4887afc0a574e9419a9695ef083460f58e4ef9a1c40793523ce112251273bdf9
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.