x47.c: The Botnet That Burns AI Credits Without Touching Victim Servers

On September 23, 2026, Qrator Labs documented x47.c, a Windows botnet marketed by threat actor WraithTools that adds a novel capability to crimeware: AI API drain. The mechanism does not aim to make victim services unreachable, but to exhaust their credits with AI providers by sending billable requests directly to OpenAI, xAI, and compatible APIs. Traditional DDoS defenses remain useless because the traffic attacks the provider account, not the victim's visible infrastructure.

How Denial of Wallet Works

The core mechanism of AI API drain inverts the logic of classic DDoS. Instead of overwhelming victim servers until they become unreachable, the botnet uses valid API keys to flood provider endpoints with completion requests. As SecurityWeek reported on the Qrator research, "those requests go straight to the provider, they do not need to pass through the victim's application." The website remains reachable while the account powering its AI features is drained financially.

OWASP classifies this pattern as "denial of wallet" (DoW), an attack variant that turns resource consumption from a technical problem into direct financial damage. The danger lies in the nature of AI APIs themselves: every legitimate request is structurally identical to a malicious one, making discrimination based on traffic signature or anomalous network behavior impractical.

Autonomous Persistence with xAI Grok

The "AI Stealth" module introduces a decision-automation element that distinguishes x47.c from conventional botnets. According to Qrator research, the module "uses xAI Grok to choose from predefined actions" among startup entries, scheduled tasks, and Windows Defender exclusions. The operator enables the calls by including an xAI key in the malware build. Status messages track persistence modifications and automatic repairs, with local fallback actions when the model call fails.

It remains unverified, however, whether the use of xAI Grok is actually implemented in real-world environments or constitutes an advertised but undeployed feature. The dossier does not specify observed campaigns confirming its concrete operability.

The Criminal Supply Chain and Pricing

WraithTools has structured x47.c as a commercial, multi-tier product. The base package costs $200, the DDoS add-on $150, and the full version with all capabilities $950. The offering includes process hollowing and privilege escalation options for defense evasion, plus a fast-flux configuration with 6 domains and 8 IP addresses for command and control.

The threat actor has explicitly advertised AI API drain as a tool to hit "vibecoded projects," CMS with AI integration, trading bots, and scanners. In a message reported by Cybernews, WraithTools stated: "You can sell service to eliminate competition, tonnes of Jarvis-style systems on social media these days." The marketing announcement describes the functionality as "burn OpenAI/XAI/compatible chat APIs with heavy completion traffic (token and cost pressure, not just bandwidth)."

"Because those requests go straight to the provider, they do not need to pass through the victim's application. The website can remain reachable while the account behind its AI features runs out of credits." — Qrator Labs, via SecurityWeek

The Limits of Perimeter Defenses

AI API drain exposes a structural gap in enterprise security strategies. Traditional DDoS protection systems — WAFs, rate limiters, scrubbing centers — monitor the perimeter of the victim's infrastructure. When requests go directly to AI providers using valid credentials, none of these controls detect anomalies. The traffic does not traverse the victim's servers, does not generate measurable bandwidth spikes on their network, and does not trigger conventional alert thresholds.

The economic damage materializes instead on the AI provider's billing plane, often with detection latencies that can extend over hours or days depending on the refresh frequency of consumption dashboards. The stakes for companies that have integrated AI APIs into their services are direct: exposure is no longer just about availability, but about liquidity.

What to Do Now

The cited sources do not provide specific corrective measures. The Qrator research does not list documented technical countermeasures, and the dossier does not include usable indicators of compromise (IOCs) for detection. Outstanding questions remain: whether the stealer module directly steals AI-site tokens and converts them into API keys for the drain; the actual number of infections or confirmed victims; and whether the botnet has already conducted AI drain attacks in the wild or is solely in a sales phase.

The brief also does not specify mitigation strategies such as key rotation, spending limits, anomalous billing monitoring, or API credential segmentation. Any operational recommendation in these areas remains editorial inference unsupported by the available documentation.

Why This Changes Crimeware

The evolution of x47.c signals a shift in the economic value of crimeware: from bits to dollars, from bandwidth saturation to forced consumption of paid resources. If the model proves scalable, AI providers become indirect targets and API keys become more attractive assets than the infrastructure itself. The MaaS (Malware-as-a-Service) market has already baked AI capabilities into its pricing; the next step will be measuring the return on investment for buyers, which will depend on the ability to extract value from others' credits without leaving detectable traces.

The challenge for the defensive sector is that the perimeter to defend no longer coincides with the visible perimeter. As long as valid API keys remain the access vehicle, effective control shifts to the plane of identity and credential lifecycle management — a domain traditionally slower to adapt than offensive techniques.

Frequently Asked Questions

How does AI API drain differ from traditional DDoS?

Classic DDoS aims for service unavailability by overwhelming servers or networks. AI API drain keeps services reachable while exhausting the economic credits of the AI account at the provider. Perimeter defenses do not detect the traffic because it does not transit the victim's infrastructure.

Is the use of xAI Grok in the AI Stealth module confirmed in real attacks?

The dossier does not confirm it. The module is documented as an advertised seller feature with a technical description of the mechanism, but observed campaigns verifying its actual implementation in real environments are lacking.

What are the targets declared by the threat actor?

WraithTools has indicated "vibecoded projects," CMS with AI integration, trading bots, and scanners. No data on specific victims or confirmed infections emerges from the available dossier.

Sources

• https://www.securityweek.com/new-x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/
• https://www.infosecurity-magazine.com/news/x47c-botnet-ai-api-draining-18/
• https://cybernews.com/security/hackers-advertise-ai-token-draining-service/
• https://mallory.ai/stories/01a0cea0-28eb-7d2b-9eaa-59ae1edf44ed
• https://www.scworld.com/brief/new-windows-botnet-offers-ai-credit-draining-and-other-attack-methods
• https://podcast.securityweek.com/

Information has been verified against cited sources and is current as of publication.

Sources