Calm down. · Both
Calm down: the "AI" in this RAT mostly wants your OpenAI bill.
On Oct 29, Cisco Talos wrote up NIK C2, which it calls "the new AI-enabled command-and-control framework." Underneath the label is a Go remote access tool for 64-bit Windows with a long list of very ordinary features and one new one: a command called ai_generate that sends the operator's prompt to OpenAI's Chat Completions API from the infected machine. If the operator doesn't bring their own API key, the implant grabs the victim's OPENAI_API_KEY and bills them for it. That's real and it's rude, but it's a key-abuse and billing problem wearing an "AI malware" badge. Calm down.
Talos's own conclusion goes big, saying the compromised host becomes "an autonomous operational asset." The technical sections are more modest. The implant passes along a prompt, gets text back and sends it to the operator, with a 60-second timeout.
Claimed vs. confirmed
| What the doom version says | What the sources say |
|---|---|
| It's AI malware that thinks for itself | Talos describes the operator sending a prompt through ai_generate and getting the model's text, plus a token count, sent back to the panel. It doesn't describe the model choosing or running commands on the machine. |
| It's spreading everywhere | Talos describes one active server, at 87.120.196[.]120 resolving total-sitevv[.]lol, with a certificate whose name, nik-panel, matches strings in the implant. That's what let it "assess with moderate confidence that NIK C2 is not merely a proof of concept, but a fully functional, AI-integrated C2 framework." Its IOC file lists one more C2 address, 2[.]26[.]51[.]12 on port 4443, that the post doesn't discuss. Talos found samples in the wild spanning at least three versions, but it doesn't say how the implant reaches victims or how many there are. |
| It hacks your OpenAI account | It doesn't log into anything. If the operator supplies no key, it reads the OPENAI_API_KEY environment variable on the infected machine. In Talos's words, "OpenAI's billing system will charge the victim's payment method, and OpenAI's access logs will show the victim's API key as the one that made the requests." No key in that variable, nothing to spend. |
| The AI part is the dangerous part | The boring parts are worse. Talos lists "over 52 commands," including a browser, Wi-Fi, Discord and crypto wallet stealer, a live keylogger, hidden remote desktop (HVNC), RDP session hijacking, an AMSI bypass, a UAC bypass via fodhelper.exe and a screen locker that demands Bitcoin or USDT. The locker "does not encrypt any files." |
The boring lesson
If this lands on a machine, the stolen browser passwords and the keylogger are your incident, and the OpenAI charges are the cherry on top. So the fix for the scary part is the usual one: don't get the RAT, and rebuild the machine if you do.
The AI part is worth five minutes anyway, because it points at a habit a lot of us have. OpenAI's own quickstart and key safety guide tell Windows users to run setx OPENAI_API_KEY "<yourkey>" or add it under User variables. That's good advice for keeping keys out of git, and it's also exactly the variable NIK C2 asks Windows for. setx writes it to the registry so every future window sees it (Microsoft), and a key that sits there forever, uncapped, on a laptop that also runs whatever came in the mail is the actual problem. Your API key is a credit card with no limit until you give it one.
What to do:
- Find out which Windows machines have a permanent
OPENAI_API_KEY. Why: that's the one place the implant looks, per Talos. How: in PowerShell,[bool][Environment]::GetEnvironmentVariable('OPENAI_API_KEY','User')and the same with'Machine'print True or False without showing the key. User variables live inHKEY_CURRENT_USER\Environmentand machine ones underHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment(Microsoft). If you don't need it there all the time, remove it and set it per session instead ($env:OPENAI_API_KEYin PowerShell only lasts for that window). That's my read on narrowing exposure, not a Talos recommendation, and it doesn't make an infected machine safe. It's also builders checklist item 1: get keys out of your dotfiles and inject them at runtime. - Put a hard spend limit on the project the key belongs to. Why: OpenAI's key safety guide is blunt that alerts alone don't stop anything: "Spend alerts alone don't stop API traffic." How: per OpenAI's spend limits guide, go to Project settings, select Limits, then in Spend select Edit spend limit, enter the Monthly spend limit and turn on Enforce a hard limit. Once tracked spend hits it, requests get a
429withproject_spend_limit_exceeded. Enforcement isn't instantaneous, so spend can run slightly over. Do the same at the organization level under Organization limits. That's builders checklist item 2: one key per tool, with a spend cap. - Add spend alerts below the cap. Why: a hard limit tells you after the fact, and an alert gives you time to look. How: add alerts on the same Limits page. OpenAI's projects article says a new project spend limit gets an alert at 100% by default, and Add Alert sets other thresholds, sent to organization and project owners plus anyone you add.
- Actually look at usage per key. Why: OpenAI's access logs will show your key, not the attacker's, so your usage is where this shows up. How: check the Usage page. Per OpenAI's production best practices, keys created before Dec 20, 2023 don't have tracking on by default, so turn it on from the API key management dashboard, or that usage shows up as "Untracked."
- Give keys an expiry and rotate the ones on any machine you're unsure about. Why: a short-lived key limits how long a stolen one is worth anything. How: OpenAI's key safety guide says project keys can be created with an expiration date, admins can enforce a maximum key lifetime at the organization or project level, and if you think a key leaked, "rotate your key immediately from the API Keys page."
- Don't count on IP allowlisting for this one. Why: OpenAI's IP allowlisting rejects requests from addresses you haven't listed, but Talos says NIK C2 sends its request from the victim machine's own IP. If that machine is allowed to call the API, so is the implant. How: still worth turning on for servers with fixed IPs, which is where OpenAI says it's most commonly used. It just won't catch this.
- If a machine shows NIK C2 indicators, rebuild it and rotate everything it touched. Why: the stealer goes after browser passwords and cookies, saved Wi-Fi passwords, Discord tokens and wallets, plus files whose names include words like
seed,walletorsecretwith text or key-file extensions, and the keylogger streams live. How: check Talos's IOC file (hashes and network indicators, including87.120.196[.]120,total-sitevv[.]loland2[.]26[.]51[.]12) and the ClamAV signatureWin.Trojan.GoDiscorder-10060526-0. Look for Talos's leftovers too: aSystemLockvalue in the user's Run key,lock_screen.htmlandbootkit.binin the temp folder, and a copy of the implant under what Talos writes as%appdata%/Roaming/Microsoft/Network. Then rebuild, and change passwords from a clean device, not the infected one.
Want the next one?
One email, weekly-ish. The week's briefs, how worried to be, and what to do about it. No doom.
Subscribe on Beehiiv ↗Free. Opens Beehiiv in a new tab. Unsubscribe whenever, I won't be offended.Sources
- Cisco Talos: NIK C2: The new AI-enabled command-and-control framework (Oct 29, 2026)
- Cisco Talos IOCs on GitHub (2026/10)
- OpenAI Help Center: Best practices for API key safety
- OpenAI: Spend limits
- OpenAI Help Center: Managing projects in the API platform
- OpenAI: Production best practices
- OpenAI: Developer quickstart
- OpenAI Help Center: IP allowlisting for OpenAI API
- Microsoft: setx
- Microsoft: EnvironmentVariableTarget enum