New x47.c Windows Botnet Weaponizes xAI Grok for AI-Powered Persistence and API Draining

Researchers detail a Windows botnet that calls xAI Grok to manage its own persistence and pioneers "AI API draining" against stolen provider keys

A threat actor operating under the handle WraithTools has been advertising a new Windows botnet called x47.c on underground forums since early August 2026, combining conventional DDoS, credential theft, and proxy capabilities with two AI-specific features rarely seen together in commodity malware. Researchers at Qrator Research Labs published a technical writeup on September 23, 2026, based on the seller's advertisement, technical documentation, control-panel screenshots, and follow-up messages with the operator. The botnet's "AI stealth" module calls xAI's Grok model to choose from a predefined list of host-maintenance actions — recreating startup entries, scheduling tasks, repairing persistence, and adding Windows Defender exclusions — while a separate "AI API drain" command abuses stolen OpenAI, xAI, and compatible chat-API keys to run up victims' AI billing balances, a technique OWASP classifies as denial of wallet (DoW).

x47.c is sold as a tiered package: a $200 base license, a $150 DDoS add-on, or a $950 bundle that includes the full feature set. It is offered alongside a command-and-control panel covering bot management, fast-flux domain/IP rotation, infostealer logs, SOCKS5 proxy controls, and 18 distinct DDoS attack methods.

Details

How x47.c Works

The "AI stealth" persistence module

Rather than hardcoding a fixed persistence routine, x47.c's stealth module hands decision-making to xAI's Grok. Once an operator enables the feature by embedding a valid xAI API key in the build, the malware periodically queries the model and selects from a predefined menu of maintenance actions: recreating startup registry entries or scheduled tasks, repairing broken persistence, and adding Windows Defender exclusions to keep the payload from being flagged. Qrator noted that the bot's status messages explicitly report back these actions — "startup changes, persistence repair, and Windows Defender exclusions" — suggesting the AI call is used more as a lightweight decision layer over a fixed action set than as an open-ended autonomous agent. Optional process hollowing and privilege escalation modules extend the same persistence logic. Critically, the malware includes local fallback actions for when a model call fails or the key is invalid or rate-limited, so infected hosts keep functioning without a live connection to Grok — the AI integration is a convenience layer for the operator, not a single point of failure for the botnet.

"AI API drain": a denial-of-wallet attack on stolen keys

The bundle's most novel capability targets AI providers directly rather than the victim's infrastructure. The "AI API drain" command takes a valid, usually stolen or exposed, API key for OpenAI, xAI, or a compatible chat-completions API and fires a stream of repeated billable requests straight to the provider — bypassing the victim's own application and any rate limiting or WAF protection it might have in front of it. Because the requests never touch the victim's website or API gateway, the site or app can remain fully operational while the linked AI account's balance, credit line, or usage quota is silently exhausted. This is a variant of the denial-of-wallet (DoW) pattern that OWASP has flagged as an emerging risk for LLM-integrated applications, adapted here into an off-the-shelf botnet feature rather than a bespoke attack.

Credential theft, proxying, and cleanup

x47.c's infostealer component harvests browser-stored passwords and cookies, Discord tokens, cryptocurrency wallet data, and tokens tied to AI-service accounts — the last of which likely feeds directly into the API-drain feature by supplying fresh stolen keys. A SOCKS5 proxy module turns infected machines into relay points for outbound traffic, and a rootkit module can remove rival malware from a compromised host, a common commodity-malware behavior aimed at maximizing the value of each infected machine for its current operator.

Command-and-control and DDoS infrastructure

The C2 panel gives buyers a management console covering bot inventory, fast-flux configuration (6 domains and 8 IP addresses, with per-host hostname/IP preferences), stealer log review, proxy controls, and concealment settings. The DDoS module advertises 18 attack methods, including HTTP floods, slow-connection floods, TCP/UDP floods, TLS connection stressing, and reflection/amplification techniques — a fairly standard commodity-DDoS toolkit that differentiates the offering primarily through its AI add-ons rather than raw attack novelty.

Impact Assessment

Recommendations

For AI platform administrators and API key owners

• Treat OpenAI, xAI, and other LLM API keys as high-value secrets: store them in a secrets manager, never in client-side code, mobile apps, or public repositories.
• Set hard spending limits and disable automatic credit top-ups on AI provider accounts where possible, so a drained key fails closed rather than accumulating unbounded charges.
• Regularly audit AI API billing and usage dashboards against expected traffic patterns; a sudden spike in request volume with no corresponding change in application traffic is a strong indicator of key compromise.
• Rotate any key suspected of exposure immediately, and review provider-side request logs for source IPs and patterns inconsistent with the legitimate application.

For security and IT teams

• Hunt for Windows Defender exclusion additions and unexpected scheduled-task or startup-entry creation on endpoints, particularly on hosts with no legitimate administrative change record.
• Monitor for SOCKS5 proxy activity and unusual outbound connection patterns consistent with fast-flux C2 (frequent DNS changes across a small pool of domains/IPs).
• Apply standard DDoS mitigation at both the network and application layers, since x47.c's attack suite is broad but largely conventional.
• Treat any host running unfamiliar software that also has stored AI-service credentials (browser-saved tokens, .env files, CLI config) as a priority for credential rotation after cleanup.

For end users

• Avoid downloading cracked software, game cheats, or "free" tools from unofficial sources — the typical distribution path for commodity stealer/botnet bundles like x47.c.
• Use a password manager and enable multi-factor authentication on Discord, cryptocurrency wallet, and AI-service accounts so a stolen credential alone is insufficient for takeover.
• Periodically review connected/authorized API keys on AI platform accounts and revoke any that are unrecognized or unused.

Key Takeaways

1. x47.c is a commodity Windows botnet sold by WraithTools for $200–$950, combining DDoS, credential theft, SOCKS5 proxying, and rootkit cleanup with two AI-specific features.
2. Its "AI stealth" module calls xAI Grok to select from a predefined menu of persistence actions (startup entries, scheduled tasks, Defender exclusions) and includes local fallback logic if the model call fails.
3. The "AI API drain" command is a denial-of-wallet attack that fires billable requests directly at OpenAI, xAI, and compatible providers using stolen keys, exhausting victim credits without touching the victim's own application.
4. The botnet uses fast-flux infrastructure (6 domains, 8 IPs) and offers 18 DDoS attack methods through its C2 panel.
5. Qrator Research Labs disclosed the findings on September 23, 2026, based on the seller's own advertisement and panel documentation.
6. Defenders should prioritize securing and monitoring AI API keys (spending limits, usage audits, rotation) alongside standard endpoint and DDoS defenses, since AI-account draining leaves no trace on the victim's own infrastructure.

Sources

• New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining — SecurityWeek
• x47.c Windows Botnet Offers AI API Draining, 18 Attack Methods — Infosecurity Magazine