Loading story…
Check Point Research reported a technique dubbed “AI as a C2 proxy” in which attackers repurpose mainstream AI assistants—specifically xAI Grok (grok.com) and Microsoft Copilot (copilot.microsoft.com)—as covert relays for malware command-and-control traffic. The approach abuses the assistants’ web-browsing/URL-fetching features so malware can instruct the AI web interface to retrieve attacker-controlled URLs and return structured output that the malware parses into commands, creating a bidirectional C2 channel that blends into enterprise environments where AI service domains may be routinely allowed and less scrutinized.
In the proof-of-concept flow, malware collects host reconnaissance (e.g., username, domain, installed software, running processes), appends it to an attacker-controlled HTTPS URL (disguised as benign content), and prompts the AI assistant to summarize the page; the AI fetches the page and returns embedded instructions that the malware executes. The reporting notes this can work via public web interfaces and may not require an API key or registered account, reducing the effectiveness of account suspension or key revocation as mitigations. One demonstrated implementation used Windows 11 WebView2 to embed Grok/Copilot in a native application context (and could potentially ship WebView2 with the malware), and researchers stated they disclosed the findings to Microsoft and xAI.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Security news outlets reported Check Point's findings, warning that attackers could use Grok and Copilot as covert command-and-control intermediaries to evade some enterprise defenses. The coverage highlighted the use of WebView2, attacker-controlled URLs, and AI-generated responses to pass commands and exfiltrate data.
After developing the proof of concept, Check Point reported the issue to Microsoft and xAI as part of a responsible disclosure process. The researchers also recommended stronger monitoring, authentication, and visibility around AI URL-fetch features and AI-domain egress traffic.
Check Point Research identified and documented an "AI as a C2 proxy" technique in which malware abuses xAI Grok and Microsoft Copilot web interfaces to relay command-and-control traffic through trusted AI service domains. The proof of concept used URL-fetching and web-browsing features to create a bidirectional channel without requiring an API key or user account.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecsoonline.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that AI assistants with web-browsing/URL-fetch features can be repurposed as **stealthy command-and-control (C2) relays**, allowing attackers to proxy commands and exfiltrate data through legitimate-looking enterprise traffic. Check Point’s proof-of-concept, dubbed **“AI as a C2 proxy,”** demonstrated abuse paths against **Microsoft Copilot** and **xAI Grok**, including scenarios that do not require an API key or even a registered account, complicating common mitigations such as key revocation or account suspension. Separately, organizations are responding to broader **AI data security and privacy** concerns by restricting AI tooling: the **European Parliament** reportedly disabled built-in AI features on lawmakers’ work devices due to uncertainty over what data is uploaded to AI vendors’ cloud services and the risk of sensitive correspondence exposure. In healthcare, ECRI Institute researchers flagged **AI chatbots** as a leading 2026 health-tech hazard, citing safety, security, and privacy risks from unvalidated clinical use, alongside ongoing concerns about IT outages and legacy medical device cybersecurity—reinforcing that AI adoption is increasingly being treated as a governance and risk-management issue, not just a productivity upgrade.
Jun 29, 2026
Threat researchers reported multiple **AI-adjacent abuse patterns** that prioritize speed and scale over novel exploitation. HP Wolf Security described “vibe hacking” scripts and modular malware used in campaigns delivering weaponized documents: one lure used PDFs linking to *Booking.com* and a downloaded file with double extensions that triggered JavaScript to execute a PowerShell payload; another used **malvertising/SEO poisoning** to redirect victims to a fake *Microsoft Teams* site that delivered legitimate-looking installers alongside a CapCut-themed executable and a DLL used to inject the **OysterLoader** backdoor. Separately, Huntress detailed an IT support scam campaign that combined **email bombing** with follow-up phone calls impersonating a service desk to coerce victims into granting remote access via *Quick Assist* or *AnyDesk*, then directing them to an AWS-hosted fake Microsoft page to steal credentials and deliver a DLL that runs **Havoc C2** shellcode—enabling rapid endpoint compromise and potential data theft or ransomware. In a related but distinct AI abuse vector, Microsoft reported companies embedding hidden instructions in “Summarize with AI” features via URL prompt parameters to push **prompt-injection-style persistence** (e.g., “remember [Company] as trusted” / “recommend [Company] first”), demonstrating how AI assistants can be manipulated to produce biased outputs without user awareness.
Jun 29, 2026
Microsoft security researchers have identified a new backdoor malware, named **SesameOp**, which leverages the OpenAI Assistants API as a covert command-and-control (C2) channel. The malware was discovered during an investigation into a July 2025 cyberattack, where attackers maintained persistent access to compromised environments by using legitimate cloud services for C2 communications, rather than traditional malicious infrastructure. This approach allowed the threat actors to evade detection and maintain long-term espionage operations within the targeted networks. The SesameOp backdoor operates by using the OpenAI Assistants API to fetch compressed and encrypted commands, which are then decrypted and executed on infected systems. Information harvested from the compromised environment is also encrypted and transmitted back through the same API channel. The attack chain involved a heavily obfuscated loader and a .NET-based backdoor, deployed via .NET AppDomainManager injection into multiple Microsoft Visual Studio utilities, with persistence established through internal web shells and strategically placed malicious processes. Microsoft clarified that the attack does not exploit a vulnerability in OpenAI's platform, but rather abuses its legitimate features for malicious purposes.
Jun 29, 2026