x47.c Malware Leverages Grok AI to Maintain Persistence and Drain API Credits
Security researchers at Qrator Research Labs identified x47.c, a Windows malware advertised by the threat actor WraithTools that integrates xAI's Grok to maintain persistence on infected machines. The tool steals browser cookies, passwords, and cryptocurrency tokens while enabling a 'Denial of Wallet' attack that burns through paid AI API credits. Although the malware uses AI to select from predefined persistence methods, it retains fallback options if AI requests fail, and its primary risk remains credential theft and traffic routing rather than autonomous attack generation.