Security · November 1, 2026
Cisco Talos identifies NIK C2, a new hacking tool that uses AI to analyze stolen data in real time
Cisco Talos has discovered and analyzed a new command and control tool named NIK C2 in active attack environments. The tool targets Windows operating systems and combines remote access capabilities with artificial intelligence features and ransomware functionality.
The malware allows attackers to remotely control infected computers, steal account credentials and passwords, and collect keyboard inputs in real time. It is specifically designed to harvest passwords and cookies stored in web browsers, virtual asset wallet information, and Wi-Fi passwords. Additional capabilities include screen capture, microphone recording, and lateral movement within internal networks.
A defining feature of NIK C2 is its direct integration of AI into the attack process. The tool calls the OpenAI application programming interface to analyze the data it collects. This design enables attackers to receive analysis results within the same session as the data collection, thereby shortening the time required to assess the information and prepare follow-up attacks.
The malware is also engineered to exploit the victim's own AI API keys. If the attacker does not specify a separate key, the tool locates and uses the OpenAI API key stored on the infected computer. This results in AI service calls being made under the victim's account, which may lead to unexpected usage charges. This method abuses legitimate AI services rather than indicating a breach of OpenAI's own systems.
NIK C2 includes a ransomware component that locks the computer screen and displays threatening messages. Attackers demand payment in virtual assets such as Bitcoin or Tether. Unlike traditional ransomware that encrypts files, this tool prevents normal computer use by locking the screen. It is designed to restart automatically even if the screen is forcibly closed.
Cisco Talos reports that NIK C2 supports more than 52 commands, enabling a range of attacks from credential theft to security feature bypass. While malware samples have been confirmed in real-world attacks, the specific victim companies, the scale of the damage, and the identity of the attackers have not been disclosed.