Qrator finds x47.c's AI credit drain works only with a key the attacker already holds
Qrator says x47.c, a Windows botnet sold for up to $950, burns a victim's OpenAI or xAI credit with a valid API key while the website stays up. Website filtering never sees the requests, so the defenses are key revocation and spending caps.
The Watch · Security desk
What happened
- Qrator Research Labs on September 23 described x47.c, a previously undocumented Windows botnet sold by WraithTools with 18 attack methods.
- The panel's AI API drain command sends repeated billable requests straight to OpenAI, xAI or a compatible chat API, drawing down the victim's paid credits.
- An AI Stealth module asks xAI's Grok to choose from a predefined list of persistence actions such as startup entries and scheduled tasks.
- The stealer component takes browser passwords and cookies, Discord tokens, wallet data and AI-site tokens from infected machines.
Why it matters
- What it limits constraint A website's DDoS filtering cannot see drain traffic, so the only controls that apply sit in the AI provider account: the key, the billing limit and the top-up setting.
- What it costs cost The account owner pays up to whatever extra spending the account permits, and an automatic top-up left on keeps raising that ceiling.
- Who has to decide decision Teams running AI chatbots or trading bots on a paid key now have to choose between a hard cap that lets the feature go dark and an open top-up that keeps it running on their money.
Next story · Invest · 3d ago
SpaceX accepts the NYC Council's AI subpoena after a threat of court enforcementConfirmed2 publishers
The drain needs a key the attacker already has. The operator supplies a model name and a valid API key for the target account [3]. Qrator said anyone holding a valid key could script the same attack without the botnet [10]. The stealer lists AI-site tokens among the data it takes, but the seller's documentation does not show those tokens being turned into API keys for the drain command [11].
With a key in hand, the attacker bills the victim without touching the victim's infrastructure. "Because those requests go straight to the provider, they do not need to pass through the victim's application. The website can remain reachable while the account behind its AI features runs out of credits," Qrator wrote [7]. Filtering traffic at the website will not stop the requests, Qrator said [8]. OWASP calls this class of attack denial of wallet [4].
How big the bill gets depends on how much extra spending the account allows, according to Qrator [22]. The seller pitched the drain against chatbots, AI-connected content management systems, trading bots and scanners, including as a service to use against competitors [9]. He also pointed buyers to automatic top-ups as a way to keep charges accruing after a balance runs out [9].
Qrator's advice is to revoke exposed AI keys, check billing against legitimate usage, and set spending limits and controls on automatic top-ups [19]. Those controls do different jobs. A spending limit caps the charge, but an account that hits its limit is out of credit, the same state Qrator describes for a drained account [27]. Revoking the key removes the one input the drain command cannot run without [27]. For the flood methods and the infected hosts, Qrator recommended endpoint cleanup and DDoS protection at both the application and network layers [20].
The evidence comes from the seller. Qrator drew its findings from the seller's advertisement, technical documentation, panel screenshots and follow-up messages [23]. It found no test results supporting the advertised protection-bypass modes [24]. The administrator advertises fast flux across six domains and eight IP addresses [17]. Several of those domains can point to a single server, according to Infosecurity Magazine's account of the research [18]. The priced offer dates to an August 3 advertisement [12]. The drain sits on the panel's DDoS tab [5]. The base package plus the DDoS add-on comes to $350, and the full kit costs $600 more [25][26].
The Grok-driven persistence is optional to the malware [16]. The Grok calls run on an xAI key the operator includes in the build [15]. "They also show local fallback actions when a model call fails, allowing host maintenance to continue without a successful AI response," Qrator wrote of the seller's status messages [16].
What to watch
- A confirmed victim account or provider billing record showing the x47.c drain used in the wild, beyond the seller's own materials.
- Evidence that x47.c's stolen AI-site tokens are being converted into API keys, which would let the botnet supply its own drain keys.
- Recovered x47.c samples containing the xAI key embedded for the Grok persistence calls, and whether that key gets revoked.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+25
- Incentives60
- Confidence55
Perspective Coverage
3 publishers- Builder
- Builder 35%
- Operator
- Operator 55%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A previously undocumented Windows botnet dubbed x47.c offers 18 attack methods, according to research Qrator Research Labs published on September 23; the seller is WraithTools.
- [2]
The 'AI API drain' command takes a valid API key for OpenAI, xAI or a compatible chat API and sends repeated billable requests straight to the provider.
- [3]
The operator supplies a model name and a valid API key for the targeted account on OpenAI, xAI, and compatible chat APIs to consume credits or incur charges.
- [4]
OWASP calls this type of attack denial of wallet (DoW).
- [5]
The panel's DDoS tab provides access to 18 attack methods, including HTTP floods, AI API draining, slow HTTP, TCP and UDP floods, TLS stresser, and reflection and amplification techniques.
- [6]
WraithTools also offers credential theft, SOCKS5 proxying and an AI module meant to keep the malware on infected machines.
- [7]
"Because those requests go straight to the provider, they do not need to pass through the victim's application. The website can remain reachable while the account behind its AI features runs out of credits," Qrator notes.
- [8]
Filtering traffic at the website will not stop the drain requests, Qrator said.
- [9]
The seller pitched the method against chatbots, AI-connected content management systems, trading bots and scanners, including as a service to use against competitors, and pointed to automatic top-ups as a way to keep charges accruing once a balance runs out.
- [10]
Anyone holding a valid key could script the same attack, Qrator noted.
- [11]
The botnet's stealer lists AI-site tokens among its targets, but the documentation does not show them being turned into API keys for the drain command.
- [12]
An August 3 advertisement priced the botnet from $200 to $950.
- [13]
In early August, the threat actor offered the botnet's base package for $200 and asked $150 for the DDoS add-on; the entire x47.c package was priced at $950.
- [14]
The 'AI Stealth' module uses xAI's Grok to choose from a predefined list of persistence and concealment actions, including startup entries and scheduled tasks.
- [15]
"The operator enables those calls by including an xAI key in the build."
- [16]
"They also show local fallback actions when a model call fails, allowing host maintenance to continue without a successful AI response," Qrator explains.
- [17]
According to the botnet's administrator, a fast flux configuration offers six domains and eight IP addresses in the management tab.
- [18]
What the seller calls fast flux gives bots alternative domains and IP addresses, though several of those domains can point to a single server.
- [19]
Qrator advised revoking exposed AI keys, checking billing against legitimate usage and setting spending limits and controls on automatic top-ups.
- [20]
Qrator also recommended endpoint cleanup and DDoS protection at both the application and network layers.
- [21]
x47.c can harvest passwords and cookies from the victim's browsers, and can collect Discord tokens, wallet data, and AI-site tokens.
- [22]
The resulting cost depends on how much extra spending the account allows, Qrator said.
- [23]
Qrator's findings are drawn from the seller's advertisement, technical documentation, panel screenshots and follow-up messages.
- [24]
Qrator found no test results supporting the advertised protection-bypass modes.
- [25]
The base package plus the DDoS add-on costs $350.
- [26]
The full x47.c package costs $600 more than the base package plus the DDoS add-on.
- [27]
A spending limit bounds the charge but leaves a capped account out of credit, the state Qrator describes for a drained account; revoking the key removes the valid key the drain command requires.
Sources
3 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comWindows Botnet x47.c Offers AI API Draining, 18 Attack Methods
2 articles · September 23, 2026
- scworld.comNew Windows botnet offers AI credit draining and other attack methods
1 article · September 24, 2026
- securityweek.comNew x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining
1 article · September 26, 2026
Topics and entities
Topics
- API key security
- Denial-of-wallet attacks
- Botnets and DDoS