SesameOp: New backdoor exploits OpenAI API for covert C2

SesameOp is a newly identified backdoor that Microsoft says abuses the OpenAI Assistants API for covert command-and-control within hacked systems. According to Microsoft Incident Response – Detection and Response Team (DART) researchers, the backdoor was discovered in July 2025 during an intrusion in which attackers remained hidden for months, using malicious .NET AppDomainManager injections inside Visual Studio utilities to maintain persistence.

The implant comprises a heavily obfuscated loader (Netapi64.dll) and a .NET backdoor (OpenAIAgent.Netapi64) that reads a three-part config and potentially routes traffic via a proxy, with the infected host identified by its Base64 hostname. SesameOp communicates with OpenAI by querying vector stores and Assistants, using description fields as simple command flags, and retrieves payloads that are RSA-encrypted, AES-encrypted and compressed before being executed through a JScript engine.

The loader injects the payload into the host, decrypts and loads a hidden module, and then posts results back to OpenAI as messages. Microsoft and OpenAI jointly investigated and disabled the attackers’ API key and account.