- SesameOp malware uses OpenAI Assistants API as covert command and control channel
- It allows persistent access, executes commands and exfiltrates data via encrypted API traffic
- Microsoft recommends firewall audits, tamper protection, and endpoint detection to mitigate threats
To be able to function properly, malware needs a way to communicate with its “headquarters” – the command and control (C2) server – which is one of the usual ways cybersecurity researchers identify malware – by examining suspicious communications – which is why scammers work to hide these “conversations” in plain sight.
Recently, Microsoft security researchers discovered new malware that uses a creative way to hide this dialogue, by abusing OpenAI’s Assistants API, a programming interface that allows developers to integrate OpenAI’s AI “assistant” capabilities into their own applications, products or services.
“Instead of relying on more traditional methods, the malicious actor behind this backdoor abuses OpenAI as a C2 channel in order to stealthily communicate and orchestrate malicious activity within the compromised environment,” Microsoft’s incident response team said in the report. “To do this, a backdoor component uses the OpenAI Assistants API as a storage or relay mechanism to retrieve commands, which the malware then executes.”
Used for espionage
The malware is called SesameOp and was discovered in July 2025. It grants its attackers persistent access to the compromised environment, along with the usual backdoor capabilities. All information captured during attacks is then encrypted and sent back through the same API channel.
It’s also worth pointing out that this is not a vulnerability in the OpenAI platform, but rather a built-in capability of the Assistants API that is being abused. According to BeepComputerthe API itself is expected to become deprecated in August 2026 anyway.
“The stealthy nature of SesameOp is consistent with the objective of the attack, which was determined to be long-term persistence for espionage purposes,” Microsoft added.
Those concerned about potential SesameOp malware attacks should audit their firewall logs, enable tamper protection, and configure endpoint detection in blocking mode. Additionally, they should also monitor unauthorized connections to external services.
Via BeepComputer
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp Also.
