SesameOp: Using the OpenAI Assistants API for Covert C2 Communication

Microsoft’s DART researchers disclosed SesameOp, a backdoor that uses the OpenAI Assistants API as a covert command-and-control channel rather than any OpenAI SDK, embedded in two components: the loader Netapi64.dll and the main backdoor OpenAIAgent.Netapi64. The malware uses heavy obfuscation (Eazfuscator[.]NET) and AppDomainManager injection to load at runtime, with the loader enumerating files in Temp and XOR-decode/execute targets before establishing persistence.

It reads configuration data, including a hardcoded OpenAI API key, and uses the OpenAI vector stores to create a host-named vector store on first contact, allowing commands to be fetched, decrypted, and executed, with results posted back to OpenAI as new messages.

The attackers reportedly maintained presence for several months prior to detection, and the OpenAI accounts involved were disabled after a joint Microsoft and OpenAI investigation, which also noted that the OpenAI Assistants API is scheduled for deprecation in August 2026.

The findings emphasise how threat actors blend malicious traffic with legitimate API communications to evade traditional security controls, and Microsoft advises layered security, log auditing, network segmentation, and automated response to mitigate such techniques. According to Microsoft’s DART researchers.