x47.c Malware Uses Grok to Stay Hidden and Can Burn Your AI Credits

Malware sellers love putting "AI" in their sales pitch. Most of the time it's marketing. A Windows botnet called x47.c is worth a closer look, though, because it shows two concrete ways criminals are starting to use AI services: as a helper inside the malware, and as a target to drain.

What x47.c is

The research comes from Qrator Research Labs and was reported by SecurityWeek on 26 September 2026 and CyberGuy on 2 October. A seller calling themselves WraithTools has been offering access to the botnet. SecurityWeek reports that in early August the base package was priced at US$200, a DDoS add-on at US$150, and the full package at US$950.

One important caveat, which CyberGuy spells out: Qrator based its findings on the seller's advertisement, technical documentation, screenshots and follow-up messages. So this is what x47.c is advertised and designed to do. It isn't evidence of how many PCs are infected.

According to the reports, the advertised feature list includes:

• a command-and-control panel for managing infected machines, with fast-flux configuration (six domains and eight IP addresses in the management tab);
• 18 DDoS attack methods, including HTTP, TCP and UDP floods, slow HTTP, a TLS stresser and reflection/amplification attacks;
• credential theft: browser passwords and cookies, Discord tokens, crypto wallet data and AI-site tokens;
• a SOCKS5 proxy module that relays the operator's traffic through victims' connections;
• optional process hollowing, privilege escalation, and a rootkit module promoted for removing rival malware.

The AI parts

"AI Stealth" persistence. Malware needs to survive a reboot, which is known as persistence. x47.c's AI Stealth module is advertised as using xAI's Grok to choose from a *predefined* list of persistence actions, such as startup entries and scheduled tasks. Qrator says the operator enables this by including an xAI API key in the build, and that status messages show local fallback actions when a model call fails. In other words, the AI picks between options the malware already has; it isn't inventing new techniques, and blocking the AI calls wouldn't remove an infection. CyberGuy says it asked xAI for comment and didn't hear back before deadline.

"Denial of Wallet". This is the part that should get developers' attention. One of the DDoS methods is an AI API drain: the operator supplies a model name and a *valid API key* for an OpenAI, xAI or compatible account, and the botnet hammers the provider with requests to use up credits or run up charges. As Qrator puts it, "Because those requests go straight to the provider, they do not need to pass through the victim's application. The website can remain reachable while the account behind its AI features runs out of credits."

The limit is that the attacker needs your key first. x47.c doesn't break into AI accounts; it spends keys that have already leaked, and its own info-stealer is one way to collect them.

Protect your AI API keys

If you build anything that calls an AI API, treat the key like a production password:

1. Never ship keys to the client. A key in front-end JavaScript, a mobile app bundle or a public repo is a key you've published. Put calls behind your own server.
2. Use one key per project and environment. If one leaks, you revoke one key, not your whole business.
3. Set hard spending limits and billing alerts where your provider offers them, and think twice about automatic top-ups. A drain attack hurts most when there's no ceiling.
4. Store keys as secrets, not in images or code. In containers, use environment files or Docker secrets that aren't baked into the image. My guide to Docker in production: volumes, networks and Compose secrets walks through it.
5. Watch usage. A sudden spike in requests at 3am is your early warning. Revoke and rotate immediately if anything looks off.

If a Windows PC might be infected

Cleaning the malware isn't the end of the job. CyberGuy relays Qrator's warning that removing the malware doesn't undo stolen credentials or tokens. From a clean device:

• change passwords for your email first, then banking and other important accounts;
• sign out of all sessions and revoke connected apps and tokens you don't recognise, because stolen cookies can keep an attacker logged in even after a password change;
• rotate any API keys that were stored or used on that machine.

And the usual basics still do most of the work: keep Windows updated, don't run "fix" commands that a web page tells you to paste into PowerShell, and only install software from sources you trust.

The takeaway

The AI in x47.c is modest: it picks persistence options and spends stolen credits. But it's a preview of where commodity malware is heading. AI services are now both a tool for attackers and a target worth stealing. Paid API keys deserve the same care as card details.

Catch the short version

This story is covered on Riff's AI Headlines, a YouTube channel for quick, sourced AI and cybersecurity news. Subscribe to Riff's AI Headlines on YouTube for the next one.