Infosecurity Magazine (23 September 2026) reports research published by Qrator Research Labs on 23 September on a previously undocumented Windows botnet, x47.c, sold by WraithTools and offering 18 attack methods. Qrator's findings are drawn from the seller's advertisement, technical documentation, panel screenshots and follow-up messages. The "AI API drain" command takes a valid API key for OpenAI, xAI or a compatible chat API and sends repeated billable requests straight to the provider — what OWASP calls denial of wallet — so a victim's website can stay up while the AI features behind it run out of credit; filtering traffic at the website will not stop it, Qrator said.

The other methods include HTTP floods, slow HTTP connections, TCP and UDP floods, TLS connection stress and reflection and amplification techniques; Qrator found no test results supporting the advertised protection-bypass modes. An "AI Stealth" module uses xAI's Grok to assess the infected host and choose from predefined persistence and concealment actions, with local fallbacks when model calls fail. The stealer targets browser passwords, cookies and Discord tokens and lists AI-site tokens among its targets; a SOCKS5 module turns infected machines into relays, and what the seller calls fast flux gives bots alternative domains and IP addresses.

An August 3 advertisement priced the botnet from $200 to $950. Qrator advised revoking exposed AI keys, checking billing against legitimate usage, setting spending limits and controls on automatic top-ups, endpoint cleanup and DDoS protection at both the application and network layers. (source: Infosecurity Magazine, citing Qrator)

Correction (31 Oct 2026): replaced SecurityWeek, which this desk cannot read, with Infosecurity Magazine as the card's main source and removed details that only SecurityWeek gave. (source: Infosecurity Magazine)