The new idea in this command-and-control framework is not that it calls a model. It is that the victim's API key pays for the calls
2026-10-30AI
Talos published NIK C2 on 29 October. If the operator supplies no key, the implant reads OPENAI_API_KEY from the infected machine, so the inference is billed to the victim and the provider's logs point at the victim.