x47.c Botnet Markets xAI Grok for Persistence and Direct AI API Credit Draining

The botnet provides a C2 panel with 18 DDoS vectors, SOCKS5 proxy relays, credential harvesting from browsers and Discord, and a dedicated AI API drain function. Operators supply a target model name and valid API key; requests hit OpenAI, xAI, and compatible endpoints directly to exhaust paid credits without routing through the victim's web application. Fast-flux DNS with six domains and eight IPs supports C2 resilience while optional rootkit and process-hollowing modules remove competing malware. Qrator's reporting documents the advertised build process that embeds an xAI key, returning status messages on persistence repair and Defender exclusions. Local fallback logic ensures continued operation when model calls fail. No independent samples or telemetry have surfaced yet, leaving claims of active deployment unverified beyond the seller's marketing. This marks an operational shift where generative AI is used not for payload generation but for runtime decision-making on infected hosts, reducing reliance on static configurations that signature-based detection catches. It aligns with patterns seen in prior botnets that adopted cloud APIs for C2, now extended to paid AI services as both tool and target. Procurement records from AI providers show no public acknowledgment of such abuse vectors despite rising credit-consumption incidents. Next steps include monitoring for Grok API traffic anomalies originating from consumer Windows endpoints and tracking underground forums for x47.c updates or sample leaks within the next 30-45 days.