Meta News

A new Windows botnet called x47.c is combining traditional malware capabilities with artificial intelligence, using xAI’s Grok to help maintain persistence on compromised computers.

Security firm Qrator says the botnet is being sold by a threat actor known as WraithTools and offers a broad collection of capabilities, including distributed denial-of-service attacks, credential theft, SOCKS5 proxies, malware deployment, and an unusual attack designed specifically to drain victims’ paid AI API credits.

The malware provides another example of AI being incorporated into operational cybercrime, although Grok does not independently control the botnet. Instead, the model helps choose between actions already predefined by the malware’s developers.

One of x47.c’s most unusual components is its “AI stealth” module.

The feature can communicate with xAI’s Grok API and ask the model to select from predefined persistence mechanisms available on the infected Windows machine.

Those options include creating startup entries and scheduled tasks. The malware can also use process hollowing and privilege-escalation functionality.

The botnet operator must supply an xAI API key when building the malware to enable the AI functionality.

Importantly, x47.c does not become dependent on Grok. If the AI request fails, the malware can fall back to conventional locally implemented persistence techniques.

This creates a hybrid design in which AI influences decisions but traditional malware logic ensures the infection can continue operating without it.

Another unusual capability is called AI API draining.

Instead of attempting to knock an AI-powered service offline directly, attackers use stolen API credentials to generate large volumes of requests against commercial AI providers.

The operator supplies a valid API key and model name, and infected computers generate requests to services including OpenAI, xAI, and compatible chat APIs.

The objective is financial exhaustion.

Because requests are sent directly to the AI provider, the victim’s website or application can remain completely operational while the associated account silently consumes its API allowance or accumulates charges.

This creates a new variation of resource-exhaustion attacks. Instead of consuming bandwidth or CPU resources, attackers consume paid inference tokens.

x47.c also functions as a conventional DDoS botnet.

Its control panel provides operators with 18 attack methods, including HTTP floods, TCP and UDP floods, slow HTTP attacks, TLS stressing, and several reflection and amplification techniques.

The botnet also uses fast-flux infrastructure to make its command-and-control network more resilient.

Operators can configure multiple domains and IP addresses while dynamically changing which infected machines communicate with particular infrastructure.

The same control panel allows attackers to manage infected computers, download additional software, deploy updates, remove programs, and select DDoS targets.

The malware includes information-stealing capabilities that can extract valuable information from infected Windows systems.

It can target browser passwords and cookies, Discord tokens, cryptocurrency wallet information, and authentication tokens associated with AI services.

Those stolen credentials can potentially support additional attacks.

Browser cookies, for example, may allow attackers to hijack authenticated sessions, while stolen AI API credentials could be fed directly into x47.c’s API-draining functionality.

Compromised computers can also operate as SOCKS5 proxies, allowing other malicious traffic to be routed through residential or corporate systems and making its true origin harder to identify.

Qrator observed WraithTools advertising x47.c in underground markets beginning in August.

The base botnet package was offered for $200, while the DDoS module cost another $150. The complete package containing all advertised functionality was priced at approximately $950.

The relatively low price demonstrates how sophisticated cybercrime capabilities continue to become accessible as commercial products.

Buyers do not necessarily need to develop their own command-and-control infrastructure, credential stealer, proxy network, DDoS tooling, or AI integration. Those components are packaged together behind a management interface.

The significance of x47.c is not that Grok independently decides whom to attack.

The AI component is much narrower: it helps choose how the malware should maintain itself on a compromised computer from a predefined collection of actions.

But that still represents an important development.

Traditional malware relies heavily on deterministic logic written by its developers. Integrating an LLM potentially allows malware to make more contextual decisions without requiring developers to anticipate every possible configuration of a victim’s machine.

At the same time, the AI API draining capability demonstrates another emerging security problem:AI accounts themselves are becoming valuable resources worth stealing and abusing.

API keys now represent not only access credentials but direct financial value because every request can consume paid tokens.

x47.c therefore combines two different AI-era threats. Artificial intelligence becomes part of the malware’s decision-making process, while access to AI infrastructure becomes something the malware can steal, monetize, and deliberately exhaust.

It is a small but notable indication of how conventional cybercrime is beginning to adapt to an environment where both AI models and AI credentials are part of the attack surface.