---
id: "CMP-202610-nik-c2-new-windows-malware-framework-seen-in-the-wild-steals"
kind: "campaign"
aliases: []
title: "NIK C2: new Windows malware framework seen in the wild steals credentials, logs keystrokes, can lock screens for ransom, and uses the victim's own OpenAI API key to analyze stolen data"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Windows", "fixed": []}, {"name": "OpenAI API", "fixed": []}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-29T10:25:09+00:00"
updated_at: "2026-10-29T10:25:09+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T10:25:09+00:00"}]
---

# NIK C2: new Windows malware framework seen in the wild steals credentials, logs keystrokes, can lock screens for ransom, and uses the victim's own OpenAI API key to analyze stolen data

Cisco Talos (2026-10-29) observed NIK C2, an AI-integrated command-and-control framework, with an active C2 server in the wild. Its Go-based 64-bit Windows implant (at least three versions, built with Go 1.23.4, so no earlier than late 2024) has 52+ commands: stealing browser passwords, cookies, crypto wallets, Discord tokens and Wi-Fi passwords, live keylogging, screen/camera/mic capture, clipboard swapping, HVNC, RDP session hijacking, process hollowing, lateral movement, and a screen-locking ransomware module that demands Bitcoin or USDT. Its ai_generate command sends operator prompts to the OpenAI Chat Completions API from the victim's machine, and when the operator gives no key it uses the victim's OPENAI_API_KEY environment variable, so the victim pays and OpenAI logs show the victim's key. Windows users and developer workstations with OpenAI API keys in the environment are at risk. Initial access method and targets: unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Windows affected ? fixed ?
- :OpenAI API affected ? fixed ?

## How to check

Network: 87.120.196[.]120, total-sitevv[.]lol, TLS cert with CN 'nik-panel' (serial 7d16381a9de823943b5a0987dbd0f26edf22052b, JARM 28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b), WebSocket on 443 plus HTTP polling every 250 ms. Host: copies of svchost.exe or simvol.exe running from %APPDATA%\Roaming\Microsoft\Network, new autostart Run registry entries, PE TimeDateStamp zeroed with file times set to 1979, embedded string /opt/nik_panel/data/build_*/main.go, log string '[NIK] Starting'. Unexpected calls to api.openai.com/v1/chat/completions from endpoints that should not make them, or OpenAI usage on your key you cannot explain.

## Fix

Block the listed IP/domain and alert on the 'nik-panel' certificate. Hunt endpoints for the host indicators. On any infected host: isolate, rotate all browser-stored passwords, session cookies, Wi-Fi keys, Discord tokens and wallet keys, and revoke/rotate any OpenAI API key that was in the environment. Avoid keeping long-lived OpenAI API keys in user environment variables on workstations; set OpenAI project spend limits and watch usage.

## Timeline

- 2026-10-29T10:25:09+00:00 analyst

## Documents

- [describes] Cisco Talos: NIK C2: The new AI-enabled command-and-control framework https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_