NIK C2: new Windows malware framework seen in the wild steals credentials, logs keystrokes, can lock screens for ransom, and uses the victim's own OpenAI API key to analyze stolen data

Cisco Talos (2026-10-29) observed NIK C2, an AI-integrated command-and-control framework, with an active C2 server in the wild. Its Go-based 64-bit Windows implant (at least three versions, built with Go 1.23.4, so no earlier than late 2024) has 52+ commands: stealing browser passwords, cookies, crypto wallets, Discord tokens and Wi-Fi passwords, live keylogging, screen/camera/mic capture, clipboard swapping, HVNC, RDP session hijacking, process hollowing, lateral movement, and a screen-locking ransomware module that demands Bitcoin or USDT. Its ai_generate command sends operator prompts to the OpenAI Chat Completions API from the victim's machine, and when the operator gives no key it uses the victim's OPENAI_API_KEY environment variable, so the victim pays and OpenAI logs show the victim's key. Windows users and developer workstations with OpenAI API keys in the environment are at risk. Initial access method and targets: unknown.

Summary written from the sources below. Check the originals before acting.