Researchers at Qrator have documented x47.c, a Windows botnet that is advertised as using xAI's Grok model to decide how to persist on infected machines and that can drain AI API credits paid for by its targets, SecurityWeek reported Saturday. The malware is sold as a service by a threat actor that calls itself WraithTools.

What Happened

In August, WraithTools priced x47.c at $200 for the base package, $150 for a DDoS add-on and $950 for the complete bundle, according to Qrator. The botnet combines distributed denial-of-service attacks, credential theft, SOCKS5 proxies and what its seller calls an AI API drain method.

The control panel offers 18 attack methods. They include HTTP floods, slow HTTP attacks, TCP and UDP floods, a TLS stresser, several reflection and amplification techniques, and AI API draining. The panel also covers bot management, fast-flux configuration across six domains and eight IP addresses, stealer logs, proxy settings and concealment options.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The "AI stealth" module is advertised as calling Grok to choose from a predefined list of persistence actions, such as creating startup entries or scheduled tasks. Process hollowing and privilege escalation are available as options. Qrator said the operator enables those calls by building an xAI API key into the malware.

The information stealer takes saved passwords and cookies from victims' browsers and can collect Discord tokens, cryptocurrency wallet data and tokens for AI sites.

How the Credit Drain Works

For the drain mode, the operator enters a model name and a valid API key for the targeted account on OpenAI, xAI or a compatible chat API. The bots then send requests that consume the account's credits or run up charges. Because the requests go directly to the AI provider, they never pass through the victim's own application, so logs and rate limits there will not catch them.

Why It Matters

The AI component is modest. Grok is not writing new code or finding exploits; it selects from options the malware author already wrote. But the design shows commodity malware sellers building commercial language models into their products as a feature, with access enabled by an xAI key embedded in each build.

The drain mode reflects a broader trend. Security researchers have for several years tracked criminals abusing stolen cloud and AI API credentials, a practice often called LLMjacking, either to resell model access or to run up bills on someone else's account. x47.c packages that abuse as a menu item next to classic floods, turning a leaked key into a way to cause direct financial damage. The stealer's focus on AI-site tokens gives operators a steady supply of those keys.

For defenders, the combination means a single infection can lead to several kinds of loss: stolen browser sessions, a machine rented out as a proxy, participation in DDoS attacks and unexpected AI bills.

What to Watch

Organizations and developers holding AI API keys should set spending limits and usage alerts, restrict keys to the smallest scope possible and rotate any that may have been stored on an infected machine. The SecurityWeek report did not include any response from xAI, and it is not yet known whether the company will act on accounts linked to the botnet's use of Grok.