Cisco Talos discovered a new malware framework called NIK C2 that can use victims' OpenAI API keys to perform AI queries, charging the costs to the victim while concealing the attacker’s identity.
The vulnerability or weakness
The malware leverages victims' OpenAI API keys to send AI requests from their machines, bypassing the need for the attacker to provide their own key.
Earlier attacks and coverage
- Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys (2026-10-29)
- Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware (2026-10-26)
- Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware (2026-10-20)
- OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys (2026-10-19)
Business impact
Organizations with OpenAI API keys on compromised systems may incur unexpected charges, impacting their finances and potentially revealing sensitive data through billing and access logs.
Industries affected
This affects a wide range of industries, including finance, healthcare, and technology, as any organization using OpenAI services could be at risk.
Users affected
Users whose systems are compromised may have their data and keys misused, leading to unauthorized AI requests and potential financial losses.
Build these skills
Watch the daily brief
Sources
- NIK C2 Malware Can Use Victims’ OpenAI Keys for AI Queries (Infosecurity Magazine)
