# Cisco Talos details malware that analyzes stolen data through OpenAI API

_Published Thursday, October 29, 2026 at 5:21 PM EDT · Security, AI · Latest · Tier 2 — Notable_

![Cisco Talos details malware that analyzes stolen data through OpenAI API — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoNTh5CKLvFJeeXzWn1LVT-e9435oFtUz4jT-4TmZaWkRUY_RY8EAtijUWxQztoK3K_tU_csSw54MuVeX8UzeT6ZWNLtTMex5pMS4z4Npz-aYAN9qIfWk2bUsei5nswh3UkzycVlKznVjK7n1I_knJ-p1I59RoX_TECTfr-NPej9LWoDt2UuwvLY4heSip/s1700-nu-rw-lo-l85-e365/t-day.jpg)

Cisco Talos disclosed NIK C2, a malware framework that combines credential theft and surveillance with AI analysis inside a compromised Windows session. Talos says attackers use the OpenAI Chat Completions API to analyze harvested data.

The implant can record keystrokes, dump credentials, hijack remote desktop sessions and deploy a screen-locking ransomware module demanding Bitcoin or USDT. Talos identified three versions dating from August 12, 2026, and says the framework joins data collection and exploitation in a continuous session.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/threatsday-critical-firewall-flaws.html)

---
Canonical: https://techandbusiness.org/newswire/x5Ww_V80EnMr9rkZK-r55q
Published: 2026-10-29T21:21:06.629Z
Story chronology: 2026-10-29T19:11:00.000Z
Retrieved: 2026-10-29T23:40:28.157Z
Publisher: Tech & Business (techandbusiness.org)