Qrator Research Labs analyzed seller materials for a previously undocumented Windows botnet called x47.c that offers an AI API drain command plus credential theft, SOCKS5 proxying, DDoS methods and an AI-assisted persistence module.
x47.c includes an "AI API drain" command that sends repeated billable requests to AI providers using a valid API key, creating a denial-of-wallet attack without taking the victim application offline.
The botnet bundles 18 attack methods: credential theft, SOCKS5 proxying, multiple DDoS techniques, and an AI-based "stealth" module that aims to maintain persistence and disable protections.
The stealer targets browser passwords, cookies and Discord tokens, and documentation lists AI-site tokens as targets but does not show them converted into API keys for the drain command.
# What x47.c is and why it matters Qrator Research Labs published an analysis of seller materials for a Windows botnet called x47.c. The package advertises 18 attack methods and an "AI API drain" feature that uses valid API keys to generate billable requests against AI providers such as OpenAI and xAI. Because the drain requests are sent directly to the provider, an application can remain online while the AI feature's credit balance is exhausted.
# How the AI API drain works The advertised AI API drain takes a valid API key and issues repeated, billable calls to a chat or compatible API. This technique is a form of denial of wallet: it consumes paid credits tied to a key rather than aiming to take services offline. The seller pitched the method against chatbots, AI-connected content management systems, trading bots and automated scanners, and suggested using automatic top-ups to keep charges accumulating after a balance is exhausted.
# Other capabilities in the x47.c offering The x47.c package lists a mix of data-theft, proxying and denial-of-service techniques:
# AI-assisted persistence and concealment
# What Qrator found and did not find Qrator's conclusions are based on the advertisement, technical documentation, panel screenshots and follow-up messages supplied by the seller. The research notes the stealer lists AI-site tokens among targets but the documentation does not show those tokens being converted into API keys for the drain command. Qrator also found no test results supporting the seller's claims that protection-bypass or other advertised defensive-evasion modes were validated.
# Pricing and distribution
# Practical defensive steps Qrator recommended immediate containment steps for organizations that suspect exposure to this threat or similar attacks:
# Bottom line x47.c packages multiple commercially familiar malware features with a specialized AI billing-abuse capability. The risk vector is straightforward when an attacker has a valid API key: repeated provider calls can deplete paid credits while leaving applications operational. Addressing exposed keys, enforcing billing controls and hardening endpoints and DDoS defenses reduce the immediate risk.
A new Windows malware named ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously determine the actions to take during post-compromise stages of an attack. [...]
A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finis
Cybersecurity researchers have identified a threat actor that leverages artificial intelligence throughout the attack lifecycle to conduct search engine optimization (SEO) fraud, steal data, and maintain persistence in compromised environments. What is the threat? The threat actor, UAT-10147, uses a […]
'first' publicly documented Windows implant to use LLMs for C2
RatHat's C2 panel now builds malware and ranks victims with AI across nearly 100 deployments
AvisLoader, a newly observed Windows malware loader designed to maintain operator access even when conventional command-and-control infrastructure is disrupted. Instead of relying on a fixed domain, IP address, or centralized server, the malware uses the encrypted Tox peer-to-peer messaging network to receive commands
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.