A new piece of Windows malware is giving cybercriminals a lot of ways to cause trouble from one infected PC.
asserted
piece → give → PC
It can steal passwords, grab browser cookies, route internet traffic through your computer and even burn through paid AI credits.
asserted
It → steal → credits
Then there is the part that caught my attention.
asserted
that → be → attention
The malware, called x47.c, can reportedly use xAI's Grok to help decide how to keep itself running on an infected Windows computer.
uncertain
malware → call → computer
Security researchers at Qrator Research Labs uncovered x47.c while tracking cybercrime activity.
asserted
researchers → uncover → activity
A threat actor using the name WraithTools has been advertising access to the malware, which comes with tools for stealing credentials and launching attacks.
asserted
which → use → attacks
Qrator based its findings on the seller's advertisement, technical documentation, screenshots and follow-up messages, so the research shows what x47.c is advertised and designed to do rather than how widely it is currently infecting Windows PCs.
asserted
it → base → PCs
Here's how it works, what the AI connection really means and the steps you can take to protect your Windows PC and accounts.
asserted
you → work → PC
Watch the replay and discover 5 ways AI can help you get better health care.
asserted
you → watch → care
Our free CyberGuy LIVE class Get Better Healthcare with AI has ended, but you can still watch the full replay.
asserted
you → get → replay
Kurt "CyberGuy" Knutsson walks you through five practical ways AI can help you prepare for appointments, remember important details, understand complicated medical information, research prescription questions and organize your next steps.
asserted
you → walk → steps
No technical experience is needed.
asserted
experience → need → ?
Plus, recordings of all our past classes are available, including How to Stop Spam, Phone Security and Financial Protection, each with a free downloadable checklist.
asserted
recordings → include → checklist
Watch the free replays and get your checklists at CyberGuyLive.com
How this Windows malware works
Once x47.c infects a Windows computer, the attacker can remotely control it through a management panel.
asserted
attacker → watch → panel
Security researchers call that a botnet, but the important part for you is much simpler: someone else can potentially use your computer without your permission.
asserted
someone → call → permission
The operator can tell infected machines to launch online attacks.
asserted
operator → tell → attacks
They can also steal information from those computers or use the victim's internet connection to route other traffic.
asserted
They → steal → traffic
Qrator found 18 advertised attack methods built into x47.c.
asserted
Qrator → find → x47.c
Some can overwhelm websites and online services with traffic.
asserted
Some → overwhelm → traffic
Another targets something far newer: paid AI accounts.
asserted
Another → target → something
Hackers can burn through paid AI credits
Many developers and businesses pay OpenAI, xAI and other AI companies based on how much they use their services.
asserted
they → burn → services
Access to those services often relies on a secret API key.
asserted
Access → rely → key
You can think of that key as a password that lets an app communicate with an AI service and charge usage to an account.
asserted
app → think → account
If an attacker gets a valid API key, x47.c includes a feature that can repeatedly send requests to the AI provider.
asserted
that → get → provider
Those requests can use up prepaid credits or increase the victim's bill.
asserted
requests → use → bill
Qrator describes this as a "Denial of Wallet" attack.
asserted
Qrator → describe → attack
The victim's website could keep working normally while the AI account behind part of it quietly chews through its available balance.
uncertain
account → keep → balance
The attacker already needs a valid API key.
asserted
attacker → need → key
x47.c does not magically break into an OpenAI or xAI account and create one.
asserted
x47.c → break → one
Still, that can become expensive quickly if an account allows automatic top-ups or high spending limits.
asserted
account → become → ups
Grok can help the malware stay on your PC
The Grok connection sounds complicated, but the basic idea is pretty straightforward.
asserted
idea → help → PC
Malware often tries to make sure it starts again after you reboot your computer.
asserted
you → try → computer
Security researchers call that persistence.
asserted
researchers → call → that
x47.c includes what its seller calls an "AI Stealth" feature.
asserted
seller → include → what
According to Qrator, it can use Grok to look at the state of the infected computer and select from a predefined list of ways to maintain that access.
uncertain
it → accord → access
Those options include adding programs that run when Windows starts and creating scheduled tasks that can launch automatically.
asserted
that → include → tasks
Grok does not appear to freely invent new attacks or control everything the malware does.
asserted
malware → appear → everything
Instead, it helps choose among options that the malware already has.
asserted
malware → help → that
The malware can also fall back on its own built-in methods if the AI request fails.
asserted
request → fall → methods
So, cutting off its access to Grok would not necessarily remove the infection.
asserted
cutting → cut → infection
…and 58 more, not listed.
The Aporia
