Next-Gen Stealth: Malware Hides C2 Traffic as Fake LLM API Requests on Tencent Cloud

The Akamai Hunt team has uncovered a new malware strain that hides its command-and-control traffic behind what appears to be legitimate large language model API requests on Tencent Cloud, signalling a disturbing evolution in attacker tradecraft as organisations increasingly integrate AI technologies, with the discovery announced on 20 November 2025.

The malware initially attempts a direct socket connection to 39.97.57[.]244; if that fails, it switches to an HTTP C2 endpoint designed to resemble an OpenAI-compatible API at 1347790942-k1bok35vg3.ap-guangzhou.tencentscf[.]com/v1/chat/completions, hosted on Tencent Cloud Serverless Cloud Functions to provide elastic scaling and geographic distribution.

According to Akamai, the endpoint exposure is deliberate to look more legitimate for defenders and network administrators, as this API endpoint is increasingly common with AI agents and automation tools. Once decoded, the C2 response delivers instructions that grant full control over the victim’s machine, with examples including a $HunterInfo instruction that exfiltrates configuration files from remote access tools via the same XOR/Base64 pipeline.

Embedded in the malware are three .NET payloads forming a SOCKS5/HTTP proxy toolkit used to forward attacker traffic through the victim’s network, and a suspicious RAR archive on VirusTotal contains a malicious LNK disguised as “个人简历.lnk” along with multi-stage loader components that abuse a signed binary from Sangfor Technologies. The report notes that the toolset is part of a single malware ecosystem, rather than isolated components.