New Windows botnet offers AI credit draining and other attack methods

As detailed in Infosecurity Magazine, a newly identified Windows botnet named x47.c has emerged, offering a wide array of 18 distinct attack methods, notably including a feature designed to deplete victims' paid AI credits.

The botnet, sold by WraithTools, includes capabilities for credential theft, SOCKS5 proxying, and an AI module for malware persistence, Qrator Research Labs reports. A significant feature is the "AI API drain" command, which exploits valid API keys for services like OpenAI and xAI. This attack, termed denial of wallet (DoW) by OWASP, repeatedly sends billable requests directly to the AI provider, bypassing the victim's application and leaving their website functional while draining AI credits. The seller promotes this method against chatbots, AI-integrated content management systems, and trading bots, suggesting its use against competitors and highlighting automatic top-ups as a way to sustain charges.

Other attack vectors include various DDoS methods like HTTP floods and UDP floods, alongside an "AI Stealth" module that uses AI to assess infected hosts and implement concealment actions. Qrator Research Labs advises users to revoke exposed AI keys, monitor billing, set spending limits, and implement endpoint security and layered DDoS protection.

Source: Infosecurity Magazine