New x47.c Botnet Targets AI API Credits, Offers 18 Attack Vectors
A newly discovered Windows botnet, dubbed x47.c, is being marketed with a suite of 18 attack methods, including a novel capability to drain paid AI API credits from victims.
A previously undocumented Windows botnet, identified as x47.c, has surfaced on the cybercrime market, offering a diverse arsenal of 18 distinct attack methods. Notably, this botnet includes a feature specifically designed to exploit paid artificial intelligence (AI) application programming interfaces (APIs), a capability that cybersecurity researchers are calling 'denial of wallet' (DoW).
According to research published by Qrator Research Labs, the botnet is being sold by a vendor named WraithTools. Beyond the AI API draining, x47.c is advertised with functionalities for credential theft, SOCKS5 proxying, and an AI-assisted module aimed at maintaining persistence on infected systems. The seller has also promoted the AI draining feature as a service that can be used against competitors, highlighting the potential for business disruption and sabotage.
The "AI API drain" command operates by taking a valid API key for services like OpenAI, xAI, or other compatible chat APIs and then initiating repeated, billable requests directly to the provider. This attack vector bypasses the victim's application, meaning that while the AI features are being drained of credit, the victim's website or service may remain operational. This makes traditional traffic filtering at the website level ineffective against such attacks, as noted by Qrator.
The financial impact of these attacks can vary significantly, depending on the credit limits and automatic top-up features associated with the compromised AI accounts. The seller has even suggested that automatic top-ups can ensure continuous accrual of charges once an initial balance is depleted. While any user with a valid API key could theoretically script a similar attack, the botnet automates and scales this process for malicious actors.
In addition to its unique AI-targeting capabilities, x47.c offers a range of more traditional cyberattack tools. These include various forms of Distributed Denial of Service (DDoS) attacks, such as HTTP floods, slow HTTP connections, TCP and UDP floods, and TLS connection stress techniques. The botnet also supports reflection and amplification methods for DDoS attacks, though Qrator researchers found no independent verification for the advertised protection-bypass modes.
An "AI Stealth" module within x47.c leverages AI models, specifically mentioning xAI's Grok, to analyze the infected host. Based on this analysis, the module selects and implements predefined persistence and concealment actions. Seller documentation indicates that these actions can include repairing persistence mechanisms and creating exclusions within Windows Defender, with local fallbacks in place should AI model calls fail.
The botnet's stealer component is designed to exfiltrate sensitive data, including browser passwords, cookies, and Discord tokens. Furthermore, a SOCKS5 proxy module transforms infected machines into relays, enabling attackers to route malicious traffic through the victim's network. The botnet also employs a fast flux technique, allowing bots to switch between alternative domains and IP addresses, often pointing multiple domains to a single command-and-control server.
Qrator Research Labs has advised organizations to revoke any exposed AI API keys, meticulously review billing statements for discrepancies, and implement strict spending limits and controls on automatic top-ups for AI services. They also recommend standard security practices such as endpoint cleanup and deploying robust DDoS protection at both the application and network layers to mitigate the threat posed by the x47.c botnet.