Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
A Windows botnet called x47.c can spend victims’ paid AI credits, steal data, and flood websites. Its operator markets it as an attack toolkit for remote use.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
The AI drain feature requires a valid API key for the account being charged... it cannot bill an account without a valid key belonging to that account.
Startup entries and scheduled tasks support persistence; fallback actions work if the model call fails.
Startup entries and scheduled tasks support persistence; fallback actions work if the model call fails.
The AI drain feature requires a valid API key for the account being charged... it cannot bill an account without a valid key belonging to that account.
Startup entries and scheduled tasks support persistence; fallback actions work if the model call fails.
Startup entries and scheduled tasks support persistence; fallback actions work if the model call fails.
“Optional process hollowing and privilege escalation capabilities are also available.”
The AI drain feature requires a valid API key for the account being charged... it cannot bill an account without a valid key belonging to that account.
Startup entries and scheduled tasks support persistence; fallback actions work if the model call fails.
“A rootkit module is also promoted for removing artifacts associated with rival malware.”
“Optional process hollowing and privilege escalation capabilities are also available.”
The AI drain feature requires a valid API key for the account being charged... it cannot bill an account without a valid key belonging to that account.
“Status messages can indicate startup changes, persistence repairs and Windows Defender exclusions.”
The botnet, sold by WraithTools, includes capabilities for credential theft, SOCKS5 proxying, and an AI module for malware persistence.
The stealer targets browser passwords, cookies and Discord tokens.
The botnet gives operators control of infected Windows machines and can collect browser passwords, cookies, and Discord tokens.
The botnet gives operators control of infected Windows machines and can collect browser passwords, cookies, and Discord tokens.
Other modules collect browser data and turn infected machines into SOCKS5 traffic relays... The relay sends traffic out through the victim’s network, potentially hiding where the operator actually sits.
“They can select DDoS targets and download, update or remove software from compromised hosts.”
Bots remember a working command server and try alternatives if it fails. The panel shows six domains and eight IP addresses... This resembles fast flux infrastructure used to sustain malicious connections.
The AI drain feature requires a valid API key for the account being charged... bots send requests directly to an AI provider. Accepted requests consume credits or generate charges.
“The DDoS section provides 18 attack methods, including HTTP floods, slow HTTP attacks, TCP and UDP floods, TLS stresser activity, and reflection and amplification techniques.”
The panel also offers HTTP floods, slow connections, TCP and UDP floods, and other service disruption methods.
The documented methods include TLS connection stress and reflection attacks that aim to overload network services.
Other attack vectors include various DDoS methods like HTTP floods and UDP floods.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.