x47.c Windows Botnet Weaponizes xAI Grok API for Persistence

A newly identified Windows botnet, dubbed x47.c, uses the xAI Grok API to select from predefined malicious actions, enabling it to maintain persistence and drain AI API resources on infected systems.

Disclosed 26 September 2026 · Record updated 1 October 2026

Impact

Windows systems are infected by a botnet that leverages the Grok AI API to autonomously choose malicious actions, aiding persistence and abusing AI API resources.

Our coverage

A puppet master's hand guides marionettes through a fog, whispering commands into an oracle's ear while invisible threads drain golden coins from sleeping victims' pockets.

Incidents

Windows botnet x47.c uses xAI's Grok API to pick its next move

SecurityWeek reported on 26 September 2026 that the malware calls out to xAI's Grok to choose from a list of preset actions and drains AI API credits on infected machines.

26 Sept 2026

Sources

securityweek.comhttps://securityweek.com/new-x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining