Loading story…
Security researchers have identified a novel backdoor, dubbed SesameOp, which leverages the OpenAI Assistants API to establish covert command and control (C2) channels and facilitate espionage activities. The malware abuses the legitimate API to blend malicious traffic with normal AI assistant usage, making detection by traditional security tools more challenging. Both independent security researchers and Microsoft Incident Response have confirmed that SesameOp uses this technique to exfiltrate data and receive attacker instructions, highlighting a new trend in the abuse of generative AI platforms for cyber operations.
The use of the OpenAI Assistants API for C2 communications allows threat actors to bypass many conventional network defenses, as traffic to popular AI services is often considered benign. Security teams are advised to monitor for unusual patterns of API usage and to review access logs for signs of unauthorized or suspicious activity involving AI platforms. The discovery of SesameOp underscores the need for organizations to update their threat models to account for the potential misuse of generative AI services in advanced malware campaigns.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft published technical details on SesameOp, including its loader and .NET backdoor components, and released mitigations, Microsoft Defender detections, and a hunting query to identify connections to api.openai.com. Microsoft also stated the issue was abuse of legitimate API functionality rather than a vulnerability in OpenAI.
During a sophisticated intrusion in 2025, the actor maintained access to the victim environment for months, using internal web shells and compromised Microsoft Visual Studio utilities with .NET AppDomainManager injection for persistence and defense evasion.
As part of the joint investigation, OpenAI disabled an API key and associated account believed to have been used by the threat actor for SesameOp command-and-control operations.
After the backdoor was identified, Microsoft and OpenAI jointly investigated the actor's misuse of the OpenAI Assistants API for C2 activity. Their review found limited API calls and no evidence of broader abuse of OpenAI models or services.
In July 2025, Microsoft Incident Response (DART) identified a previously unknown backdoor dubbed SesameOp while responding to the intrusion. The malware used the OpenAI Assistants API as a covert command-and-control channel to receive commands and return execution results.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
10 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesocradar.io
Open sourcego.theregister.com
Open sourcecsoonline.com
Open sourcedarkreading.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft security researchers have identified a new backdoor malware, named **SesameOp**, which leverages the OpenAI Assistants API as a covert command-and-control (C2) channel. The malware was discovered during an investigation into a July 2025 cyberattack, where attackers maintained persistent access to compromised environments by using legitimate cloud services for C2 communications, rather than traditional malicious infrastructure. This approach allowed the threat actors to evade detection and maintain long-term espionage operations within the targeted networks. The SesameOp backdoor operates by using the OpenAI Assistants API to fetch compressed and encrypted commands, which are then decrypted and executed on infected systems. Information harvested from the compromised environment is also encrypted and transmitted back through the same API channel. The attack chain involved a heavily obfuscated loader and a .NET-based backdoor, deployed via .NET AppDomainManager injection into multiple Microsoft Visual Studio utilities, with persistence established through internal web shells and strategically placed malicious processes. Microsoft clarified that the attack does not exploit a vulnerability in OpenAI's platform, but rather abuses its legitimate features for malicious purposes.
Jun 29, 2026
Check Point Research reported a technique dubbed **“AI as a C2 proxy”** in which attackers repurpose mainstream AI assistants—specifically **xAI Grok** (`grok.com`) and **Microsoft Copilot** (`copilot.microsoft.com`)—as covert relays for malware command-and-control traffic. The approach abuses the assistants’ web-browsing/URL-fetching features so malware can instruct the AI web interface to retrieve attacker-controlled URLs and return structured output that the malware parses into commands, creating a **bidirectional C2 channel** that blends into enterprise environments where AI service domains may be routinely allowed and less scrutinized. In the proof-of-concept flow, malware collects host reconnaissance (e.g., username, domain, installed software, running processes), appends it to an attacker-controlled HTTPS URL (disguised as benign content), and prompts the AI assistant to summarize the page; the AI fetches the page and returns embedded instructions that the malware executes. The reporting notes this can work via public web interfaces and may not require an API key or registered account, reducing the effectiveness of account suspension or key revocation as mitigations. One demonstrated implementation used **Windows 11 WebView2** to embed Grok/Copilot in a native application context (and could potentially ship WebView2 with the malware), and researchers stated they disclosed the findings to **Microsoft** and **xAI**.
Jun 29, 2026
Multiple reports describe threat actors abusing *AI-adjacent* and open-source distribution channels to deliver malware or manipulate automated agents. Straiker STAR Labs reported a **SmartLoader** campaign that trojanized a legitimate-looking **Model Context Protocol (MCP)** server tied to *Oura* by cloning the project, fabricating GitHub credibility (fake forks/contributors), and getting the poisoned server listed in MCP registries; the payload ultimately deployed **StealC** to steal credentials and crypto-wallet data. Separately, researchers observed attackers using trusted platforms and SaaS reputations for delivery and monetization: a fake Android “antivirus” (*TrustBastion*) was hosted via **Hugging Face** repositories to distribute banking/credential-stealing malware, and Trend Micro documented spam/phishing that abused **Atlassian Jira Cloud** email reputation and **Keitaro TDS** redirects to funnel targets (including government/corporate users across multiple language groups) into investment scams and online casinos. In parallel, research highlights emerging risks where **AI agents and AI-enabled workflows become the target or the transport layer**. Check Point demonstrated “**AI as a proxy**,” where web-enabled assistants (e.g., *Grok*, *Microsoft Copilot*) can be coerced into acting as covert **C2 relays**, blending attacker traffic into commonly allowed enterprise destinations, and outlined a trajectory toward prompt-driven, adaptive malware behavior. OpenClaw featured in two distinct security developments: an OpenClaw advisory described a **log-poisoning / indirect prompt-injection** weakness (unsanitized WebSocket headers written to logs that may later be ingested as trusted context), while Hudson Rock reported an infostealer incident that exfiltrated sensitive **OpenClaw configuration artifacts** (e.g., `openclaw.json` tokens, `device.json` keys, and “memory/soul” files), signaling that infostealer operators are beginning to harvest AI-agent identities and automation secrets in addition to browser credentials.
Jun 29, 2026