x47.c Malware Uses Grok for Persistence, Packs 18 Attack Methods

Q: Why does changing your passwords no longer protect your accounts after a device is infected by this new cybercriminal toolkit?

Changing your password alone may no longer protect you because x47.c is designed to steal not just passwords, but also the browser cookies, session tokens and API keys that keep accounts already logged in. Those stolen cookies and tokens act like temporary proof that you already passed the login screen. If an attacker has them, they can often open your email, cloud apps, social platforms or Discord account without re-entering the password or sometimes even triggering multi-factor authentication. That is why security researchers warn that a password reset protects the next login, but may not invalidate sessions that were already active when the malware stole them. The same problem applies to paid AI services. If attackers steal a valid API key, they do not need your password at all. They can continue sending requests and running up charges until that key is rotated or revoked, which is the basis of the reported “Denial of Wallet” risk. Experts say the response to an infection has to go beyond changing passwords. Victims should sign out of all active sessions where possible, revoke refresh tokens and remembered devices, rotate or delete exposed API keys, review account login history and mailbox or app rules, and enable phishing-resistant MFA where available. Those steps should be taken from a clean device after disconnecting the infected PC, because malware left running can simply steal the new credentials again.

2 articles · Updated · Fox News · Oct 5

Qrator Research says x47.c is being marketed as a Windows malware platform that can use xAI’s Grok to choose persistence methods, while also stealing credentials and remotely controlling infected PCs.
Grok’s role appears limited to selecting from built-in options such as startup entries and scheduled tasks; the malware can still fall back on its own persistence methods if AI access fails.
18 advertised attack methods include password and browser-cookie theft, Discord and crypto token harvesting, SOCKS5 proxying through victims’ internet connections, and botnet-style attacks launched from a central panel.
A separate “Denial of Wallet” feature can drain paid AI credits by abusing already-stolen API keys, potentially running up bills without disrupting the victim’s website or app.
Qrator said its findings come from sales ads, technical documents, screenshots and follow-up messages, showing what x47.c is designed to do rather than how widely it has infected Windows machines.