- SesameOp malware uses OpenAI’s Assistants API as a covert command-and-control channel
- It enables persistent access, runs commands, and exfiltrates data via encrypted API traffic
- Microsoft urges firewall audits, tamper protection, and endpoint detection to mitigate threats
To be able to operate properly, malware needs a way to communicate with its “headquarters” - the command & control (C2) server - which is one of the usual ways cybersecurity researchers identify malware - by looking at suspicious communications - which is why crooks go to lengths to try and hide these “conversations” in plain sight.
