NIK C2 malware can use victims' own OpenAI keys for its AI queries
Cisco Talos identified a new Go-based command-and-control framework called NIK C2 that gives attackers remote access, credential theft, keylogging and surveillance capabilities, with a built-in OpenAI client that lets them analyze stolen data within the same compromised session. If the operator supplies no key of their own, the malware automatically reads the OPENAI_API_KEY environment variable on the infected machine and uses it, something Talos describes as a deliberate design choice. As a result, the victim's own billing account pays for the attacker's requests while OpenAI's logs show only the victim's key, leaving no trace back to the real operator. For a business with API keys sitting on staff machines, the case shows a breach can turn directly into unpredictable AI usage costs, on top of data theft.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.