Evidence · DiggingBeagle record
Cisco Talos: NIK C2 framework using an infected host as an AI API client
Talos report on AI API access in command-and-control and separate coercive modules in the same malware tooling.
- Published
- Oct 29, 2026
- Source role
- primary disclosure
Evidence record
Talos report on AI API access in command-and-control and separate coercive modules in the same malware tooling.
Claim-level citations (1)
- supportsNIK C2 used victim-host AI API access as an attacker-controlled capability: Talos documented NIK C2 code paths that make AI API requests from an infected host, separate from conventional malware modules whose effective deployment remains unverified.
Talos analysis, AI API client functionality, credential usage and modular capabilities