Loading story…
Microsoft security researchers have identified a new backdoor malware, named SesameOp, which leverages the OpenAI Assistants API as a covert command-and-control (C2) channel. The malware was discovered during an investigation into a July 2025 cyberattack, where attackers maintained persistent access to compromised environments by using legitimate cloud services for C2 communications, rather than traditional malicious infrastructure. This approach allowed the threat actors to evade detection and maintain long-term espionage operations within the targeted networks.
The SesameOp backdoor operates by using the OpenAI Assistants API to fetch compressed and encrypted commands, which are then decrypted and executed on infected systems. Information harvested from the compromised environment is also encrypted and transmitted back through the same API channel. The attack chain involved a heavily obfuscated loader and a .NET-based backdoor, deployed via .NET AppDomainManager injection into multiple Microsoft Visual Studio utilities, with persistence established through internal web shells and strategically placed malicious processes. Microsoft clarified that the attack does not exploit a vulnerability in OpenAI's platform, but rather abuses its legitimate features for malicious purposes.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed that the SesameOp malware was using the OpenAI Assistants API as part of its attacks. No earlier or additional distinct real-world events are provided in the reference content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified a novel backdoor, dubbed **SesameOp**, which leverages the OpenAI Assistants API to establish covert command and control (C2) channels and facilitate espionage activities. The malware abuses the legitimate API to blend malicious traffic with normal AI assistant usage, making detection by traditional security tools more challenging. Both independent security researchers and Microsoft Incident Response have confirmed that SesameOp uses this technique to exfiltrate data and receive attacker instructions, highlighting a new trend in the abuse of generative AI platforms for cyber operations. The use of the OpenAI Assistants API for C2 communications allows threat actors to bypass many conventional network defenses, as traffic to popular AI services is often considered benign. Security teams are advised to monitor for unusual patterns of API usage and to review access logs for signs of unauthorized or suspicious activity involving AI platforms. The discovery of SesameOp underscores the need for organizations to update their threat models to account for the potential misuse of generative AI services in advanced malware campaigns.
Jun 29, 2026
Check Point Research reported a technique dubbed **“AI as a C2 proxy”** in which attackers repurpose mainstream AI assistants—specifically **xAI Grok** (`grok.com`) and **Microsoft Copilot** (`copilot.microsoft.com`)—as covert relays for malware command-and-control traffic. The approach abuses the assistants’ web-browsing/URL-fetching features so malware can instruct the AI web interface to retrieve attacker-controlled URLs and return structured output that the malware parses into commands, creating a **bidirectional C2 channel** that blends into enterprise environments where AI service domains may be routinely allowed and less scrutinized. In the proof-of-concept flow, malware collects host reconnaissance (e.g., username, domain, installed software, running processes), appends it to an attacker-controlled HTTPS URL (disguised as benign content), and prompts the AI assistant to summarize the page; the AI fetches the page and returns embedded instructions that the malware executes. The reporting notes this can work via public web interfaces and may not require an API key or registered account, reducing the effectiveness of account suspension or key revocation as mitigations. One demonstrated implementation used **Windows 11 WebView2** to embed Grok/Copilot in a native application context (and could potentially ship WebView2 with the malware), and researchers stated they disclosed the findings to **Microsoft** and **xAI**.
Jun 29, 2026
Threat researchers reported multiple **AI-adjacent abuse patterns** that prioritize speed and scale over novel exploitation. HP Wolf Security described “vibe hacking” scripts and modular malware used in campaigns delivering weaponized documents: one lure used PDFs linking to *Booking.com* and a downloaded file with double extensions that triggered JavaScript to execute a PowerShell payload; another used **malvertising/SEO poisoning** to redirect victims to a fake *Microsoft Teams* site that delivered legitimate-looking installers alongside a CapCut-themed executable and a DLL used to inject the **OysterLoader** backdoor. Separately, Huntress detailed an IT support scam campaign that combined **email bombing** with follow-up phone calls impersonating a service desk to coerce victims into granting remote access via *Quick Assist* or *AnyDesk*, then directing them to an AWS-hosted fake Microsoft page to steal credentials and deliver a DLL that runs **Havoc C2** shellcode—enabling rapid endpoint compromise and potential data theft or ransomware. In a related but distinct AI abuse vector, Microsoft reported companies embedding hidden instructions in “Summarize with AI” features via URL prompt parameters to push **prompt-injection-style persistence** (e.g., “remember [Company] as trusted” / “recommend [Company] first”), demonstrating how AI assistants can be manipulated to produce biased outputs without user awareness.
Jun 29, 2026