NIK C2 Malware Falls Back to Your OPENAI_API_KEY: What Talos Found and What to Check

Cisco Talos published a write-up on October 29, 2026 of a command-and-control framework it calls NIK C2, found with a live server in the wild. The Windows implant steals browser data, logs keystrokes and gives the operator hidden desktop control. One feature matters to anyone who runs coding agents: an ai_generate command sends a prompt to the OpenAI API from the victim's machine, and when the operator supplies no key, the implant uses the OPENAI_API_KEY environment variable it finds there.

If you run Claude Code, Codex or a similar agent on Windows, the practical question is whether a provider key is sitting in your environment where malware can read it. This post covers what Talos reported, what we could and could not verify, the attack chain, and what to change.

One caveat up front: Talos's own post was listed on its blog index when we wrote this, but we could not load the full article page. The technical details below come from the Talos blog listing and the detailed coverage in Cyber Security News, which quotes the Talos findings. Read the Talos original for indicators before acting on any single detail.

TL;DR

What did Talos find?

Talos observed an AI-integrated command-and-control framework in the wild and named it NIK C2. According to the coverage of the report, the implant is a Go-based, 64-bit Windows remote access program. It talks to its server over TLS-secured WebSockets on port 443, with an HTTP backup channel that checks in roughly every 250 milliseconds. Traffic is encrypted with AES-256-GCM, and the implant rotates between three server tiers so that taking down one does not cut it off.

Talos found a live server and said, with moderate confidence, that NIK C2 is a working framework rather than a proof of concept. The samples point to at least three versions, which suggests an actively maintained project.

Abusing OpenAI is not new. The coverage points to an earlier backdoor, SesameOp, that used the OpenAI Assistants API to hide command traffic. NIK C2 differs in how it uses the model: as an analyst on the victim side, inside the same session as the theft.

How the OpenAI feature works, step by step

The AI feature runs through a command named ai_generate.

1. The operator sends the implant three things: a prompt, an API key and a model name.
2. The implant builds a request and sends it to the OpenAI Chat Completions endpoint from the victim's computer.
3. It waits up to 60 seconds, reads the answer, and returns the text to the attacker's panel along with token-usage counts.
4. If no model is named, it defaults to gpt-4.
5. If no API key is supplied, it reads the OPENAI_API_KEY variable on the victim's machine.

The fifth step is the one that deserves attention. OpenAI bills the key's owner, and the account logs show the owner's key making the call. A victim with an OPENAI_API_KEY in their shell environment therefore pays for the attacker's analysis, and nothing in the OpenAI logs points to the attacker. Talos, per the coverage, calls this a deliberate design choice.

Why would an attacker want this? The implant can dump passwords and stream keystrokes. Sending that raw material to a model lets the operator ask for a summary, such as which captured strings look like credentials, without exporting the data to their own infrastructure first. Because ordinary applications call the same AI services, simply blocking those domains is not practical, which the coverage notes as well.

What else does the implant do?

The rest of the feature list is conventional but broad. The implant supports more than 52 commands:

• Theft: it copies browser databases from Chrome, Edge, Brave, Opera and Firefox, saved Wi-Fi passwords, Discord tokens and desktop crypto wallets. Two disk-wide search patterns hunt for file names containing words such as "seed", "mnemonic", "private" or "secret".
• Surveillance and control: a keylogger streams keystrokes live, hidden VNC gives desktop control the user cannot see, and proxy tunnels and RDP session control support lateral movement.
• Evasion: it renames itself to names like svchost.exe and csrss.exe, patches AMSI so PowerShell scripts are not scanned, and bypasses the UAC prompt with a fodhelper technique. It marks itself as a critical process, so ending it in Task Manager triggers a blue screen.
• Ransomware-style lock screen: it backs up the Master Boot Record, writes an HTML lock screen with payment details, opens it through mshta.exe and persists with a SystemLock Run key. It does not encrypt files. A separate bootkit-preparation feature checks UEFI, BIOS and Secure Boot status.

Indicators reported include the server IP 87.120.196[.]120, the domain total-sitevv[.]lol, a TLS certificate common name of nik-panel, a SystemLock registry Run key, and dropped files such as mbr_backup.bin, lock_screen.html, lock_start.bat, bootkit.bin and browserdata.zip in the temp folder. Take the full, authoritative list from Talos rather than from this summary.

What is confirmed and what is not

We did not run the sample, and nothing here is first-hand analysis. We also found no evidence that coding-agent users specifically are targeted. The relevance is that agent users concentrate valuable AI keys on developer machines.

What this means if you run AI coding agents

The agent is not the vulnerable part. The environment around it is. Developers who use coding agents commonly have OPENAI_API_KEY, ANTHROPIC_API_KEY or cloud keys exported in a shell profile, in .env files in the project, or in the agent's own settings. A Windows implant with disk-wide search for secrets and an environment fallback finds all three.

Concrete steps:

1. Check provider usage now. In your OpenAI account, look at usage and billing for requests, models or hours you do not recognise. Unexpected gpt-4 calls are worth a closer look, since that is the implant's default model.
2. Rotate keys held in environment variables on any Windows machine you cannot vouch for, and after any suspected infection rotate everything the machine could read: provider keys, browser-saved passwords, Discord and other tokens.
3. Set spend limits and per-project keys. A key scoped to one project with a monthly cap limits how much an attacker can bill you.
4. Stop exporting keys globally. Inject a key into a single process at launch from a secret store instead of leaving it in a profile. Environment variables are readable by any process running as your user.
5. Hunt for the indicators. Look for the SystemLock Run key, the temp-folder files above, and connections to the reported IP or domain. Talos has also released an open-source toolkit, CAIRN, that searches suspicious files for AI endpoints, prompt templates and API-key patterns.
6. Keep secrets out of what agents read. Agents read files, run shell commands and sometimes send content to a model. A key in a .env file your agent can open is a key that can be echoed into a transcript. Our posts on 26,400 live keys found in public repos and the October 2026 AI-led attacks roundup cover how stolen AI keys are being used.

What Beam can and cannot do here

Beam is local security and observability for AI coding agents. It cannot detect or remove a Windows implant, and it is not an endpoint protection product, so do not treat it as a defense against NIK C2 itself.

What it does help with is the surrounding hygiene. Beam watches what Claude Code, Codex and similar agents do and flags risky actions such as credential exposure, for example an agent reading or printing a file full of keys. Where hooks are available (Claude Code and Codex PreToolUse), workspace policy can deny such an action before it runs. Captured events are redacted before storage and stay on-device. The limits matter: the deny is hook-based rather than a kernel sandbox, scanning is heuristic, and missing cached policy fails open. A key the agent never sees is still safer than one it is stopped from leaking. See the Beam landing page for what it watches and how it works.

Where this fits in the pattern of AI-enabled attacks

Two trends meet here. Attackers are putting LLM calls inside their tooling, and they are looking for AI provider keys as a resource to steal, resell or spend. Our write-up of Wiz's seven fingerprints of agentic attacks and the Unit 42 report on a Hermes-based agent used for cybercrime describe the same direction from the incident side. The October 2026 attacks timeline tracks the month's incidents in one place.

The takeaway from NIK C2 is narrow and practical. The attacker did not need to compromise OpenAI or your agent. They needed a process on your machine and a key in your environment.

Frequently asked questions

What is NIK C2?

NIK C2 is a command-and-control framework that Cisco Talos observed in the wild and described on October 29, 2026. Its Windows implant is a Go-based 64-bit remote access program with credential theft, keylogging, hidden remote desktop and a lock-screen ransomware module, plus a command that calls the OpenAI API.

How does NIK C2 use the OPENAI_API_KEY variable?

Per press coverage of the Talos report, the ai_generate command takes a prompt, an API key and a model name. If the operator leaves the key out, the implant reads the OPENAI_API_KEY environment variable on the victim machine, so the victim is billed and the logs show the victim key.

Does this affect Claude Code or Codex users?

The reported implant targets Windows and calls OpenAI. It is not a flaw in any coding agent. It matters because developers who run agents often keep provider keys in environment variables or shell profiles, exactly where this fallback would find them.

How do I know if my OpenAI key was used by someone else?

Check the usage and billing dashboard for your OpenAI account for requests, models or time windows you do not recognise, then revoke and replace the key. Unexpected gpt-4 usage is one signal, because the implant defaults to that model when none is named.

What should I do right now?

Rotate any key that sits in an environment variable on a Windows machine you cannot vouch for, move keys to a secret store or per-process injection, set spend limits on the provider, and compare your network and host logs against the indicators published by Talos.

Related reading

• 26,400 live cloud and AI keys in public Gitee repos
• AI-led attacks in October 2026
• Wiz: seven fingerprints of agentic attacks
• Unit 42: Hermes agent used for cybercrime
• October 2026 attacks timeline

Details are accurate as of October 30, 2026, and are based on the Talos blog listing and press coverage of the Talos report. Beam is a local prototype, and indicators and findings may be updated by Talos after publication.