x47.c: A Windows Botnet for Sale That Drains AI Credit and Asks Grok How to Hide

On 23 September 2026, Qrator Research Labs published an analysis of x47.c, a Windows botnet sold by a threat actor calling itself WraithTools, whose command panel advertises eighteen denial-of-service methods, credential theft, SOCKS5 relaying and two features built on AI. One, "AI API drain", takes a valid OpenAI, xAI or compatible API key and spends the victim's credit directly at the provider while the victim's own website stays online. The other, "AI Stealth", asks xAI's Grok which of a fixed set of persistence and concealment actions to apply to an infected host. The research is drawn from the seller's advertisement, documentation and panel screenshots rather than from an observed deployment: no victim, infection count or loss figure appears in it. This account is drawn from a single record in the Orca AI Incident Archive, which files x47.c as a medium-severity incident tagged as a weapon and a credential-theft case, marks AI involvement as confirmed, and records no real-world harm.

What Qrator published, and what it did not observe

Qrator Research Labs is a network-security vendor research team, and its write-up is the single primary document behind every account of x47.c. Infosecurity Magazine, which covered the report on 23 September, states that the findings are drawn from the seller's advertisement, technical documentation, panel screenshots and follow-up messages. SecurityWeek's account followed on 26 September and describes the same basis. Neither outlet reports an infection, a nameable victim, a traffic sample or a recovered sample analysed in a lab.

The advertisement itself is dated 3 August. According to SecurityWeek, the seller offered the base package for $200 and asked $150 for the denial-of-service add-on, with the entire x47.c package priced at $950. Infosecurity Magazine describes the range as $200 to $950, with the top package adding credential theft, proxying and AI-assisted persistence.

The most useful independent check on the claims came from Thailand's national computer emergency response team rather than from another security vendor. ThaiCERT published an English advisory on 28 September 2026 stating that "many of these capabilities are based on documentation and claims published by the seller, and their effectiveness in real-world attacks has not yet been fully verified." That advisory is not an independent test, though, and it does not claim to be: its own source line points to SecurityWeek's article. It is a national CERT restating a vendor report, which is a meaningful signal that the report was read and taken seriously, and not evidence that anyone reproduced the malware.

One limitation belongs on the record here. Qrator's own page could not be retrieved from this machine on 26 October 2026; the host answered with an authorisation challenge instead of the article. Every direct quotation from Qrator in this piece is therefore reproduced as SecurityWeek and Infosecurity Magazine printed it, and should be read that way.

The AI API drain: an attack that leaves the site standing

In the panel's denial-of-service tab, alongside the conventional flood methods, sits the feature that has drawn the attention. SecurityWeek describes the operator supplying a model name and a valid API key for the targeted account on OpenAI, xAI or a compatible chat API, after which the bot sends requests that are billable. Infosecurity Magazine describes the same command as taking a valid API key and sending repeated billable requests straight to the provider.

The mechanism is worth following, because it is the reason the attack is hard to answer with a web firewall. Qrator's explanation, as SecurityWeek quotes it: "Because those requests go straight to the provider, they do not need to pass through the victim's application. The website can remain reachable while the account behind its AI features runs out of credits." Infosecurity Magazine adds Qrator's point that filtering traffic at the website will not stop them, and notes that OWASP calls this class of attack denial of wallet.

Qrator described the pitch as well as the technique. Infosecurity Magazine reports that the seller marketed the method against chatbots, AI-connected content management systems, trading bots and scanners, including as a service to use against competitors, and pointed to automatic top-ups as a way to keep charges accruing once a balance runs out. How much the attack costs the victim depends on how much extra spending the account permits.

Two qualifications keep this in proportion, and both come from Qrator. The first is that the botnet is not strictly necessary: anyone holding a valid key could script the same attack. The second is that the drain feature and the credential stealer are not shown to be wired together. The stealer lists AI-site tokens among its targets, but Infosecurity Magazine reports that the documentation does not show those tokens being turned into API keys for the drain command. The two capabilities sit side by side in one product; the chain from stolen token to drained account is not documented.

AI Stealth: a chooser, not a commander

The second AI feature is the one the headlines lead with, and it is the more modest of the two. Qrator's description, quoted by SecurityWeek: "The operator enables those calls by including an xAI key in the build. The supplied status messages report startup changes, persistence repair, and Windows Defender exclusions. They also show local fallback actions when a model call fails, allowing host maintenance to continue without a successful AI response."

Infosecurity Magazine puts the job plainly: the module uses xAI's Grok to assess the infected host and choose from predefined persistence and concealment actions. SecurityWeek adds that those actions include startup entries and scheduled tasks, and that optional process hollowing and privilege escalation capabilities are also available.

Read together, those details describe a model used as a selector. The menu is written by the malware's author; Grok picks from it, using whatever it can observe about the host. The fallback path matters more than the model call: an operator who loses access to the API, or whose key is revoked, still has a bot that maintains itself. Blocking the call degrades the feature and does not disable the malware.

That is the distinction the archive draws between x47.c and a neighbouring entry from 22 September 2026, ClosedQuorum, where a language-model panel is described as the command-and-control brain itself. In x47.c the model sits in an optional module, performing action selection and credit draining on the side. The AI role is confirmed and it is assistive, not structural — which is also why the record carries a medium severity rather than a higher one.

The rest of the kit, and where the seller's claims outrun the evidence

The AI features are two rows in a longer price list, and the conventional capabilities are what the product is mostly made of. SecurityWeek reports that the panel's denial-of-service tab exposes eighteen attack methods: HTTP floods, AI API draining, slow HTTP, TCP and UDP floods, a TLS stresser, and various reflection and amplification techniques.

Around that sit the parts that make it a botnet rather than an attack script. SecurityWeek reports the stealer harvesting browser passwords and cookies, Discord tokens, wallet data and AI-site tokens, and a SOCKS5 module that relays traffic through infected machines, with the operator able to monitor multiple proxy connections and check their health status and timeouts. The seller's fast-flux configuration offers six domains and eight IP addresses in its management tab, along with preferred hostname and IP options for individual hosts — though, as Infosecurity Magazine notes, several of those domains can point to a single server.

The operator can also download, update and remove software on a host, and the seller promotes a rootkit module for removing rival artifacts from machines it has taken. That last item is a business detail as much as a technical one: a botnet sold with a tool for evicting competitors is a product defending its installed base.

Not all of it holds up. Infosecurity Magazine reports that Qrator found no test results supporting the advertised protection-bypass modes. The seller's claims and the seller's evidence are not the same thing, and the report says so where it can.

What the researchers told defenders to do

There is no patch in this story, because there is no vulnerability to patch. x47.c is malware that has to be removed from hosts, and the defensive advice splits along that line.

For the AI accounts, Infosecurity Magazine reports Qrator's recommendations: revoke exposed AI keys, check billing against legitimate usage, and set spending limits and controls on automatic top-ups. That last item is the one that matters most for the drain feature, since the seller's own pitch depends on top-ups keeping charges accruing after a balance is exhausted.

For the endpoints, Qrator recommends cleanup of infected machines. ThaiCERT's advisory adds a monitoring list that maps directly onto what the AI Stealth module reports doing: unauthorised startup entries, scheduled tasks, and changes to Windows Defender exclusions. An organisation that watches those three things is watching the places the module says it writes.

For the network, Qrator recommends denial-of-service protection at both the application and network layers — which, given that the drain traffic never crosses the application, is protection against the other seventeen methods rather than against the drain.

What the record establishes, and what it does not

The archive files x47.c as a realised AI-related incident of medium severity, with confidence graded A, no dispute recorded, AI involvement confirmed, and no real harm recorded. Those fields are consistent with each other once the provenance is kept in view. A confidence grade describes how well documented a claim is, not whether the thing described has happened to anyone: here the documentation is strong because a research lab, two trade outlets and a national CERT all describe the same advertisement in the same terms. Nothing in that chain shows a bot in the field.

What is established: the product exists as an advertisement, with a dated price list, a documented panel, and two AI features whose behaviour is described in the seller's own status messages. What is not established: a single victim, a single infection, a single dollar of drained credit, or any confirmation that the drain command has been run against a live account. The report does not claim otherwise, and the sellers of such kits have an obvious reason to overstate what they can do.

The more durable point is smaller than the headline. A denial-of-wallet attack does not need a botnet, a model or a novel exploit; it needs an API key and a loop. What x47.c adds is packaging — the drain sold next to eighteen flood methods on the same panel, aimed at the same buyer. That packaging is what turns a scriptable nuisance into a line item, and it is the part of this report that will still be true after the specific claims about Grok have been tested or forgotten.