Severity major: Live production compromise of victim hosts with credential theft, surveillance and ransomware capability, and no bounded scope stated.
Earliest source we hold 2026-10-29 · Captured by AI Risk Wire 2026-10-29 18:31 UTC
Cisco Talos observed NIK C2, a Go-based Windows implant that gives an actor persistent control of compromised hosts and embeds an OpenAI Chat Completions API client.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingA threat actor's Go-based Windows implant, NIK C2, ran on compromised hosts with credential dumping, keylogging, screen and audio capture, lateral movement and an embedded OpenAI API client that sends actor prompts to the Chat Completions endpoint.
2 · What went wrongThe implant stole victim data and, when no API key was supplied, used the victim's own OPENAI_API_KEY, charging the victim's account and attributing the requests to the victim rather than the actor.
3 · What it reached or didIt reached the victim's browser databases, saved passwords, cookies, crypto wallets, Discord tokens, Wi-Fi passwords, keystrokes, screen, camera, microphone, clipboard and internal network via proxy and RDP pivoting.
4 · How it was caughtCisco Talos researchers observed the framework in the wild, including an active C2 server at 87.120.196[.]120 resolving total-sitevv[.]lol.
5 · What was doneIt only advises defenders to adopt continuous behavioral vigilance.
No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.