A new Windows malware framework does something unusually brazen: it makes its victims pay for the artificial intelligence it uses against them. Cisco Talos, which published its research on October 29, says the framework — dubbed NIK C2 — was observed in the wild, running on live infrastructure, and is a fully functional tool rather than a proof of concept.
NIK C2 is built around a 64-bit Windows implant written in Go, controlled through a command panel that gives its operator more than 52 commands. Those cover a modern intruder's toolkit: credential theft, browser data collection, cryptocurrency wallet access, Wi-Fi credentials, keylogging, screen capture, remote access, and evasion including process hollowing and hijacked remote-desktop sessions.
What sets NIK C2 apart is that it carries its own OpenAI client inside the implant, letting the attacker analyse stolen data without ever leaving the compromised machine.
The victim funds the attack
Through an internal command, the operator types a prompt and picks a model, and the implant sends the request to OpenAI's Chat Completions API from the infected computer, returning the answer to the operator. If the operator supplies no API key of their own, the implant falls back to reading the victim's machine for one — specifically, the OPENAI_API_KEY environment variable — a choice Talos described as deliberate design, not an accident.
The trick pays twice over. OpenAI's billing charges the victim's payment method for the attacker's queries, and the access logs show the victim's key as the one making the requests, leaving nothing that points back at the attacker. Stolen AI access can get expensive fast: researchers at METR previously found attackers burning through about $600,000 in donated credits with a single stolen key.
Talos argues the deeper shift is speed. By collapsing collection and analysis into a single continuous session, NIK C2 erases the offline processing delay that historically gave defenders a window to spot an intrusion. An attacker can now ask a model about stolen data while still inside the machine that held it.
Ransomware that encrypts nothing
NIK C2 also carries a screen-locking ransomware module — but one that encrypts no files at all. It backs up the Master Boot Record, then uses a Windows system tool to display an HTML lock screen demanding payment in Bitcoin or the Tether stablecoin. Because nothing is encrypted, there is no trail of file-modification timestamps or encryption markers for forensic investigators to follow, and a screen lock is far faster to deploy than file-encrypting ransomware.
Talos traced the framework's rapid evolution across three versions between August 12 and August 18, 2026. The first handled credential theft and a reverse proxy; the second added hidden desktop control and evasion; the third integrated the OpenAI models and the screen-lock ransomware. The researchers said that pace points to a technically proficient team with prior malware experience, actively building NIK C2 toward a full-service adversarial framework — and they assessed with moderate confidence that it is already one.
How defenders can spot it
Talos observed the framework's command server active during its research and published indicators for defenders. ClamAV detects the implant, and Talos recommends continuous behavioural monitoring rather than signatures alone, since frameworks like this keep evolving.
The practical warning is simpler: unexpected calls to OpenAI's API from ordinary endpoints are a strong clue something is wrong, and any exposed AI key should be rotated immediately. As AI tooling spreads through workplaces, an API key left in a machine's environment is no longer just a billing credential — in NIK C2's hands, it is a way to make the victim bankroll their own breach.
