Researchers identify Windows malware advertised with Grok-assisted persistence

Windows malware called x47.c is advertised with features that use Grok to help maintain access to infected computers and drain paid AI accounts, according to Qrator Research Labs. Its findings draw on a seller's advertisement, technical documentation, screenshots and follow-up messages rather than evidence of widespread infections. The Grok feature selects among predefined ways to restart the malware, including Windows startup entries and scheduled tasks. Built-in methods can take over if the AI request fails. Other advertised features steal credentials and browser sessions or relay traffic through victims' computers. An API billing attack repeatedly sends requests to consume credits or increase charges. It requires an attacker to already possess a valid API key.