Hackers Weaponize OpenAI API in NIK C2 Framework for Credential Theft and Remote System Control

A new malware framework called NIK C2 is turning the OpenAI API into a tool for cybercriminals. Its Windows implant can dump passwords, record every keystroke, take hidden control of a desktop, and send the stolen data to an AI model for analysis, all inside the same session. The tool is a Go-based, 64-bit Windows remote access program. It talks to its server over TLS-secured WebSockets on port 443. It also uses an HTTP backup channel that checks in about every 250 milliseconds. All traffic is locked with AES-256-GCM encryption, and the implant rotates between three server tiers so a single takedown does not cut it off. Researchers at Cisco Talos identified the malware and published their findings on October 29, 2026.