Hackers Weaponize OpenAI API in NIK C2 Framework for Credential Theft and Remote System Control

Attackers have built a new malware framework that uses the OpenAI API as its command-and-control channel — turning a business-approved AI service into an unmonitored exfiltration pipe. The NIK C2 framework, identified by researchers at Cybersecurity News, allows threat actors to dump passwords, log keystrokes, and take hidden desktop control while their traffic blends invisibly into legitimate API calls that most enterprise security tools pass without inspection.

What NIK C2 Is and How It Works

Traditional command-and-control frameworks — the infrastructure attackers use to direct malware on compromised systems — communicate over custom protocols or known-bad domains that security tools flag and block. NIK C2 takes a different approach: it routes all attacker instructions and stolen data through the OpenAI API, which enterprises increasingly allowlist for legitimate employee use.

The framework's capabilities, as documented by researchers, include:

• Credential dumping — extracting stored passwords from browsers, Windows Credential Manager, and application vaults
• Keylogging — capturing keystrokes to intercept credentials typed in real time
• Hidden desktop control — giving attackers remote view and control of the victim's screen without triggering visible alerts
• Exfiltration over AI API — packaging stolen data as apparent API queries, making outbound traffic look like routine ChatGPT or Copilot usage

The attack method belongs to a broader threat category called "living-off-trusted-services," where attackers abuse legitimate cloud infrastructure — Microsoft OneDrive, Google Drive, Slack — instead of standing up their own command infrastructure. NIK C2 extends this to the OpenAI API specifically because of its rapid enterprise adoption since 2024.

Part of a Broader 'Black October' Threat Wave

Researchers are characterizing October 2026 as "Black October" for AI-enabled cyber threats. Alongside NIK C2, Chinese state-sponsored actors have reportedly deployed an AI-powered penetration testing tool called ARTEX against high-value targets — intelligence agencies, defense contractors, and critical infrastructure operators. ARTEX automates reconnaissance and exploit selection in ways that compress the time between initial access and lateral movement from days to hours.

Separately, the volume of AI-assisted phishing campaigns has continued to accelerate. According to Cybersecurity News's October tracking, threat actors are increasingly using LLM-generated content to personalize spear-phishing emails at scale — removing the spelling errors and awkward phrasing that trained users once used to identify suspicious messages.

Why This Is Harder to Catch Than Standard C2

The NIK C2 technique creates a detection gap that most enterprise security stacks are not designed to close.

The problem: Security teams configure network monitoring to flag traffic to known-bad IP addresses and domains. OpenAI's API endpoints (api.openai.com) are universally recognized as legitimate, and many organizations explicitly allowlist them to support productivity tooling. Traffic inspection tools that do perform deep packet inspection on HTTPS connections are less likely to flag API calls that match the format of standard OpenAI requests.

The result: An attacker running NIK C2 on a compromised endpoint can receive instructions and send back stolen data with no anomalous destination, no unusual protocol, and no volume spike — because the traffic is shaped to look like routine AI API usage.

Security teams that want to close this gap need to move beyond destination-based blocking toward behavioral analysis: flagging endpoints that make unusually high volumes of API calls, calling APIs at odd hours, or sending unusually large payloads in API responses.

What Organizations Should Do Now

Security teams don't need to block OpenAI API access wholesale — that would disrupt legitimate workflows. The response is tighter monitoring of how that access is used:

• Baseline normal API usage per endpoint and user, and alert on deviations
• Inspect API call payloads where DLP policies permit, particularly for large outbound data volumes
• Deploy endpoint detection that flags known NIK C2 behavioral signatures — credential dumping tools running alongside API calls is a strong indicator
• Review allowlist policies to ensure they are scoped to specific applications rather than granting blanket API domain access
• Segment AI tooling so that employee-facing ChatGPT access runs through a managed proxy rather than direct API connections from endpoints

The OpenAI API itself has not been compromised. The attack exploits organizational trust in the service, not a vulnerability in the API.

What to Watch

Researchers expect copycat frameworks targeting other widely trusted AI APIs — Anthropic's Claude API, Google's Gemini API, and Microsoft's Azure OpenAI service — to appear in the near term. The technique's effectiveness depends entirely on how broadly enterprises allowlist AI traffic without inspecting it. As awareness grows and security vendors update behavioral detection rules to cover NIK C2 signatures, attackers will adapt the framework to evade new heuristics.

The ARTEX threat from state-sponsored actors is a separate but parallel concern: as AI compresses the time required to run a sophisticated intrusion, organizations that have not already reduced their mean time to detect will find the gap between access and damage shrinking faster than their defenses can respond.