Hackers sell AI token draining as a service: DDoS shift threatens massive direct losses

A previously undocumented botnet software is advertising a dreadful service – an “AI API drain.” Hackers offer to hit competitors’ chatbots, trading bots, scanners, or any other AI-connected systems with an avalanche of prompts that can exhaust credits and run up huge bills.

Qrator Labs, a cybersecurity firm, discovered a new Windows botnet package for sale. The illicit platform, called x47.c, allows botnet operators to launch costly attacks against AI API endpoints.

The new “AI API drain” feature complements 17 other typical botnet tools, such as SOCKS5 proxying, credential collection, various DDoS attack methods, and more.

“AI API drain – burn OpenAI/XAI/compatible chat APIs with heavy completion traffic (token and cost pressure, not just bandwidth),” the seller advertises.

A botnet operator can send repeated requests – a type of attack known as a denial-of-wallet.

The botnet’s current implementation is straightforward and requires the operator to provide a valid API key for the targeted AI account.

“The operator supplies that key and a model name. The bot then sends requests directly to the provider. When accepted, these billable requests consume credits or generate charges,” Qrator Labs explains in a report.

The researchers interacted with the seller, who used the moniker WraithTools, who said that “AI DDoS” works against vibecoded projects as well as any content management systems/AI assistants that use API keys to access AI services.

“You can sell service to eliminate competition, tonnes of Jarvis-style systems on social media these days,” the threat actor told researchers.

Because API requests go directly to the provider, the victim’s website or application will remain reachable even as its AI features are exhausted. The direct victim’s losses will depend on the initial balance, automatic top-ups, and any additional permitted spending.

The report doesn’t say whether botnet operators can send prompts directly to the victim’s chatbots or other AI services, but the seller noted that chatbots typically have a timer or a lockout.

Sending API requests directly to the AI provider also bypasses any traffic filtering a victim might’ve set up to protect a website.

The report highlights additional dangers posed by exposed API keys, which have already been a valuable asset for cybercriminals. Cybernews previously reported that stolen keys are often plugged into grey-market AI services to resell access to AI models, including proxy AI platforms known as transfer stations.

The botnet platform has many more capabilities for just $950

The striking AI drain feature sits alongside a conventional botnet arsenal. The x47.c platform offers a broad collection of tools and DDoS methods to overwhelm web applications.

The base package is advertised for $200, with a DDoS add-on for an additional $150.

“The full $950 package also includes credential theft, SOCKS5 proxies, and AI-assisted persistence,” the Qrator researchers said.

The 18 listed DDoS methods include HTTP floods, slow HTTP connections, TCP and UDP floods, TLS connection stress, and several reflection and amplification techniques.

Curious what others think about this story? Contribute your thoughts to the debate below.

Bots receive attack instructions through a command-and-control (C2) server, and can quickly switch to alternative domains and IP addresses when the connection fails. The researchers found at least 6 domains and 8 IP addresses used by the attackers.

Ironically, the build itself requires an AI API key for stealth and persistence. The platform relies on xAI Grok to assess the infected host’s state and choose from predefined actions.

“The operator enables those calls by including an xAI key in the build,” the researchers noted.

Operators can download, update, and remove software, including competing malware.

Two further ways to extract value from infected machines are credential theft and SOCKS5 proxying. The malware can collect browser passwords, cookies, and Discord tokens, while the SOCKS5 module turns infected computers into traffic relays.

All features are controlled from the same desktop panel.

Qrator urges companies and other developers to protect exposed AI accounts and limit potential damage by implementing spending limits and controls on automatic top-ups.