New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

New line item in the malware feature list: draining your AI bill. The x47.c Windows botnet that Qrator documented lists “AI API draining” among the 18 attack methods in its C&C panel — hand it a model name and a valid OpenAI or xAI key and it burns the credits on the account. Its stealth module also asks Grok which persistence trick to use. $200 base, $950 for the full package. A leaked LLM key is a cost incident now, not just a data one.