BotnetPublished 26 Sep 2026

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

Source SecurityWeek

Description

The x47.c Windows botnet is a malware campaign that uses AI, specifically xAI Grok, to maintain persistence on infected systems. It offers capabilities including DDoS attacks, credential theft, SOCKS5 proxying, and an AI API draining attack that exhausts victims' paid AI service credits. The botnet is controlled via a command-and-control panel with multiple attack methods and fast-flux domain configurations to evade takedown. It includes modules for persistence, privilege escalation, rootkit-based removal of rival malware, and credential harvesting from browsers and other applications.

Impact

The botnet enables distributed denial-of-service attacks that can exhaust network and system resources of targeted victims. The AI API draining attack can cause financial damage by depleting victims' paid AI service credits without disrupting their websites. Credential theft capabilities risk exposure of sensitive user data, including passwords, cookies, Discord tokens, and wallet information. The use of rootkits and privilege escalation increases the difficulty of detection and removal. The fast-flux configuration enhances resilience against takedown efforts. Overall, x47.c poses a multifaceted threat combining resource exhaustion, financial impact, and data theft.

Defensive guidance

Mitigation should focus on detection and removal of the x47.c botnet on infected Windows hosts. Network defenders should monitor for unusual outbound traffic patterns consistent with DDoS or AI API draining attacks and inspect for signs of fast-flux domain usage. Endpoint detection and response tools should be employed to identify persistence mechanisms such as scheduled tasks, startup entries, process hollowing, and rootkit activity. Credential theft can be mitigated by enforcing multi-factor authentication and rotating credentials if compromise is suspected. Since this is a malware campaign without a patch, incident response and host remediation are primary defenses.

Summary

x47.c is a Windows-based botnet sold by a threat actor named WraithTools, leveraging AI (xAI Grok) to maintain persistence and select predefined actions such as startup entries and scheduled tasks. It provides a command-and-control panel with features for managing bots, configuring fast-flux domains, launching 18 types of DDoS attacks including AI API draining (which consumes victims' AI service credits directly), and stealing credentials including browser passwords, cookies, Discord tokens, wallet data, and AI-site tokens. The botnet supports process hollowing, privilege escalation, rootkit modules to remove competing malware, and SOCKS5 proxy relay functionality. Operators can update or remove software on infected hosts and monitor proxy health. The AI stealth module uses an xAI key embedded in the build to maintain persistence and repair itself even if AI calls fail.

References

securityweek.com/new-x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Sep 2026, 12:02 UTC

References

Community reviews

Related threats