Ethical Hacking News
Microsoft has uncovered a sophisticated backdoor malware known as SesameOp that uses the OpenAI Assistants API to execute malicious commands on compromised systems. This attack takes advantage of legitimate cloud services and misuses the built-in capabilities of the API, making it difficult to detect. As a result, security teams must stay vigilant and implement measures to prevent such attacks.
The SesameOp malware uses OpenAI Assistants API as a covert command-and-control channel. The malware allows attackers to gain persistent access to compromised environments. The SesameOp malware exploits legitimate cloud services for remote device management. Microsoft and OpenAI collaborated to investigate the threat and disable the account used in the attacks. Security teams should audit firewall logs, enable tamper protection, and monitor unauthorized connections to mitigate the impact of SesameOp attacks.
Microsoft has recently discovered a new backdoor malware, dubbed SesameOp, which utilizes the OpenAI Assistants API as a covert command-and-control channel. The company's Detection and Response Team (DART) identified this malicious software during an investigation into a July 2025 cyberattack, revealing that it allowed attackers to gain persistent access to the compromised environment.
Deploying this malware also enabled threat actors to remotely manage backdoored devices for several months by leveraging legitimate cloud services. Instead of relying on traditional methods, the SesameOp malware exploits OpenAI as a C2 channel to stealthily communicate and orchestrate malicious activities within the compromised environment.
The attack chain observed by DART researchers involved a heavily obfuscated loader and a .NET-based backdoor deployed through .NET AppDomainManager injection into multiple Microsoft Visual Studio utilities. The malware establishes persistence through internal web shells and "strategically placed" malicious processes designed for long-term espionage operations.
Microsoft states that the SesameOp malware doesn't exploit a vulnerability or misconfiguration in OpenAI's platform, but rather misuses built-in capabilities of the Assistants API (scheduled for deprecation in August 2026). Microsoft and OpenAI collaborated to investigate the threat actors' abuse of the API, which led to the identification and disabling of the account and API key used in the attacks.
The stealthy nature of SesameOp is consistent with the objective of the attack, which was determined to be long-term persistence for espionage-type purposes. To mitigate the impact of SesameOp malware attacks, Microsoft advises security teams to audit firewall logs, enable tamper protection, configure endpoint detection in block mode, and monitor unauthorized connections to external services.
In conclusion, the discovery of the SesameOp malware highlights the evolving threat landscape in the digital age. As malicious actors continue to exploit emerging technologies, it is crucial for organizations to prioritize cybersecurity and stay informed about the latest threats and mitigation strategies.
Related Information:
https://www.ethicalhackingnews.com/articles/Microsoft-Unveils-SesameOp-A-Sophisticated-Backdoor-Malware-Exploiting-OpenAI-Assistants-API-ehn.shtml
https://www.bleepingcomputer.com/news/security/microsoft-sesameop-malware-abuses-openai-assistants-api-in-attacks/
Published: Mon Nov 3 17:34:08 2025 by llama3.2 3B Q4_K_M
