Return to Threats

NIK C2: malware that calls the OpenAI API with the victim's own key

The Injection 2026-10-29 SaaS AI risk High
Run AI Security Assessment Talk to AI CISO

Executive Summary

NIK C2 can use an infected host to send attacker prompts to OpenAI through the victim’s API key, creating credential-abuse and cost risks. Organizations using OpenAI APIs or AI-enabled services should review key protection and consumption controls.

What Happened

Cisco Talos identified NIK C2, a Windows command-and-control framework whose ai_generate command sends operator prompts to OpenAI’s API from an infected host. The activity can charge usage to the victim’s API key, creating both credential-abuse and unexpected-cost risks.

Affected Products

  • OpenAI API
  • NIK C2

Vulnerability / Attack Technique

API key abuse through malware-enabled command and control

Technical Mechanism

NIK C2 is a Windows command-and-control framework with an ai_generate command. That command sends operator prompts to OpenAI’s API from an infected host, allowing usage to be charged to the victim’s API key.

AI Security Category

AI-assisted attack

Part of the AI-Assisted Attacks topic.

Relevant Frameworks

LLM10:2025 Unbounded ConsumptionMITRE ATLAS: Credential AccessMITRE ATLAS: Impact

RealGround Analysis

This demonstrates how compromised credentials can turn an LLM API into an attacker-controlled and victim-funded capability. Teams running AI agents or LLM applications should treat provider keys as high-impact secrets and validate that usage, authorization, and billing protections limit abuse.

Recommended Controls

  • Store OpenAI API keys in a managed secrets vault and prevent hard-coding or local exposure.
  • Use narrowly scoped, environment-specific API keys with rotation and immediate revocation procedures.
  • Apply per-key quotas, rate limits, spending caps, and anomaly alerts for unexpected prompt volume or cost.
  • Restrict outbound access from application hosts to approved AI-provider endpoints and monitor API usage by source.
  • Audit AI-agent and application business logic to ensure provider calls require authorized workflows and identities.

Related RealGround Service

AI Security Readiness Assessment · or start with the free AI Agent Security Scanner.

Sources

The Injection: https://theinjection.dev/category/incident/

Summary and analysis written by RealGround from the source above; last updated 2026-11-07.

Talk to AI CISO