A previously undocumented Windows botnet dubbed x47.c has been found offering 18 attack methods, including one designed to drain victims’ paid AI credits.
According to research published by Qrator Research Labs on September 23, the seller, WraithTools, also offers credential theft, SOCKS5 proxying and an AI module meant to keep the malware on infected machines.
Qrator’s findings are drawn from the seller’s advertisement, technical documentation, panel screenshots and follow-up messages.
Draining AI Accounts at the Provider
The “AI API drain” command takes a valid API key for OpenAI, xAI or a compatible chat API and sends repeated billable requests straight to the provider. OWASP calls this type of attack denial of wallet (DoW).
Because the requests never pass through the victim’s application, its website can stay up while the AI features behind it run out of credit. Filtering traffic at the website will not stop them, Qrator said.
The seller pitched the method against chatbots, AI-connected content management systems, trading bots and scanners, including as a service to use against competitors. He also pointed to automatic top-ups as a way to keep charges accruing once a balance runs out.
The resulting cost depends on how much extra spending the account allows, Qrator said.
Anyone holding a valid key could script the same attack, Qrator noted. The botnet’s stealer lists AI-site tokens among its targets, but the documentation does not show them being turned into API keys for the drain command.
Read more on AI credit abuse: Attackers Steal METR API Key and Burn $600,000 in AI Credits
DDoS, Proxies and AI-Assisted Persistence
The remaining methods include HTTP floods, slow HTTP connections, TCP and UDP floods, TLS connection stress and reflection and amplification techniques. Qrator found no test results supporting the advertised protection-bypass modes.
An “AI Stealth” module uses xAI’s Grok to assess the infected host and choose from predefined persistence and concealment actions. Seller-provided status messages describe persistence repair and Windows Defender exclusions, with local fallbacks when model calls fail.
The stealer targets browser passwords, cookies and Discord tokens, and a SOCKS5 module turns infected machines into relays for traffic leaving through the victim’s network. What the seller calls fast flux gives bots alternative domains and IP addresses, though several of those domains can point to a single server.
An August 3 advertisement priced the botnet from $200 to $950, with the top package adding credential theft, proxying and AI-assisted persistence.
Qrator advised revoking exposed AI keys, checking billing against legitimate usage and setting spending limits and controls on automatic top-ups. It also recommended endpoint cleanup and DDoS protection at both the application and network layers.
