Hackers Weaponize OpenAI API in NIK C2 Framework for System Control

Executive Summary

On 29 October 2026, Cisco Talos Intelligence identified NIK C2, a Go-based Windows command-and-control framework that combines credential theft, surveillance, remote access, lateral movement, defense evasion, and screen-locking ransomware capabilities within a single implant, which can utilize OpenAI capabilities. The malware integrates the OpenAI Chat Completions API through an ai_generate command, allowing operators to submit prompts and process AI-generated responses directly from a compromised system.

NIK C2 can use an attacker-provided API key or attempt to retrieve an OPENAI_API_KEY environment variable from the victim, potentially shifting API usage and associated activity to a compromised account. Talos identified at least three implant versions and active C2 infrastructure, assessing with moderate confidence that NIK C2 is an operational framework rather than a proof of concept.

Key Takeaways

NIK C2 uses TLS-secured WebSockets over port 443 as its primary C2 channel while maintaining an independent HTTP polling mechanism that checks in approximately every 250 milliseconds. Communications are protected with AES-256-GCM, and the implant can rotate among runtime-provided, embedded, and hardcoded C2 addresses to maintain connectivity.

The implant supports more than 52 commands covering credential and cryptocurrency-wallet theft, real-time keylogging, screen capture, hidden desktop control, proxy tunneling, RDP operations, persistence, and defense evasion. Its collection capabilities target browser data, saved Wi-Fi credentials, Discord tokens, cryptocurrency wallets, wallet extensions, and files potentially containing seed phrases or private keys.

NIK C2’s ai_generate functionality sends operator prompts to the OpenAI Chat Completions API from the compromised host and returns the model response to the C2 infrastructure. If an API key is not supplied by the operator, the malware attempts to retrieve OPENAI_API_KEY from the victim’s environment, allowing a compromised API credential to be used for the requests.

The malware includes a screen-locking ransomware component that presents cryptocurrency payment demands without encrypting victim files, while additional functionality surveys UEFI or BIOS configuration and Secure Boot status for potential bootkit staging. Defense-evasion capabilities include system-process masquerading, anti-debugging checks, AMSI interference, UAC bypass functionality, process hollowing, and watchdog mechanisms designed to maintain execution.

Indicators of Compromise

Cisco Talos Intelligence has provided the following Indicators of Compromise associated with the campaign, which is provided below for RH-ISAC Core Member awareness.