CTI · reviewed · 2026-09-27

x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

Full story & timeline

MITRE ATT&CK

• T1568 Dynamic Resolution Command and Control
• T1090 Proxy Command and Control
• T1503 Credentials from Web Browsers Credential Access
• T1562 Impair Defenses Stealth
• T1496 Resource Hijacking Impact

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://www.securityweek.com/new-x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/
• https://qrator.net/blog/details/x47.c-botnet
• https://www.infosecurity-magazine.com/news/x47c-botnet-ai-api-draining-18/
• https://www.hazetec.com/briefs/20260923-x47c-windows-botnet-ai-api-credit-draining-and-18-attack-methods-revealed.html
• https://cybernews.com/security/hackers-advertise-ai-token-draining-service/
• https://www.scworld.com/brief/new-windows-botnet-offers-ai-credit-draining-and-other-attack-methods
• https://radar.offseq.com/threat/new-x47c-windows-botnet-weaponizes-xai-grok-ai-api-draining-edb2077cda357b7e