A new strain of Windows malware is raising the stakes by blending old-school theft with a fresh AI twist. The threat, known as x47.c, can snatch passwords, grab browser cookies, hijack traffic, drain AI credits and even use Grok to help decide how it keeps itself hidden on an infected machine.
Researchers at Qrator Research Labs uncovered the malware while tracking cybercrime activity and found it being marketed by a threat actor calling itself WraithTools. Their findings came from ads, documentation, screenshots and messages, which means the research reflects what the malware is built to do, not necessarily how many Windows PCs it has already reached.
Once x47.c gets onto a Windows computer, it gives attackers a remote control panel for the infected device. That setup lets a criminal treat one machine like part of a larger botnet, using it to steal data, launch attacks or pass internet traffic through the victim’s connection without permission.
The malware reportedly includes 18 different attack functions, and one of the strangest is aimed at paid AI services. If an attacker already has a valid API key, x47.c can hammer an AI provider with repeated requests until credits disappear or the billing meter starts racing upward.
That kind of abuse is often called a “Denial of Wallet” attack, and the name fits. The victim may not notice anything unusual at first, but the account behind the scenes can quietly rack up charges while normal services keep running.
The Grok angle is the part that makes this case stand out. x47.c includes an “AI Stealth” feature that can reportedly use Grok to examine the infected system and pick from a list of ways to stay resident after a reboot.
Those options are familiar persistence tricks, like setting programs to launch when Windows starts or creating scheduled tasks that fire automatically. Grok is not inventing new malware behavior from scratch, but it may help choose the best path from the playbook already built into the threat.
That also means cutting off access to Grok would not necessarily wipe the infection out. The malware still has fallback methods baked in, so the AI connection is only one piece of a broader survival strategy.
For regular users, the biggest danger may be the theft tools. x47.c is designed to grab saved browser passwords, cookies, Discord tokens, cryptocurrency wallet data and tokens tied to AI websites, which can turn one bad infection into a mess of account problems.
Browser cookies are especially tricky because they can keep someone signed in without a password. If a criminal steals an active session, changing the password alone may not end access right away, which is why checking active sessions matters so much after a compromise.
The malware also includes a SOCKS5 proxy feature, which can route traffic through the infected PC. In plain English, that means someone else’s activity can look like it came from the victim’s internet connection, while the attacker keeps using the same machine for theft or attacks.
None of this calls for panic, but it does call for discipline. Keeping Windows updated, using strong security software and steering clear of sketchy downloads still do a lot of heavy lifting, especially when fake update prompts and shady pop-ups are part of the trap.
Password hygiene matters too, and not in a boring abstract way. Reusing passwords can turn one stolen login into a pile of exposed accounts, while a password manager and two-factor authentication add friction that many attackers hate dealing with.
If an infection is suspected, the response should go beyond changing one password and hoping for the best. Active sessions should be reviewed from a clean device, suspicious logins should be signed out, and any connected apps or tokens that look unfamiliar should be revoked fast.
Developers and businesses have a separate problem on their hands with AI API keys. Those keys need to be treated like passwords, protected from public repos and watched closely for strange usage, because a stolen key can become a very expensive mistake in a hurry.
There is also a simple but important move that gets overlooked too often. If a computer starts acting strange, disconnect it from the internet, run a full scan from trusted security software and avoid following instructions that appear out of nowhere on the screen.
When the dust settles, the real lesson is not just that malware is getting smarter. It is that the old habits still matter most, because once a machine is compromised, passwords, cookies, tokens and even AI billing can all be dragged into the fallout.
