Microsoft Detects "SesameOp" Backdoor Using OpenAI's API as a Stealth Command Channel

Microsoft has disclosed a novel backdoor dubbed SesameOp that uses OpenAI Assistants API as a stealth command-and-control channel, with the attack described by Microsoft’s Detection and Response Team as a means to covertly manage compromised devices. According to Microsoft Incident Response, SesameOp fetches and executes commands via a component that relays through the OpenAI Assistants API, effectively using it as a storage or relay mechanism.

The backdoor was first discovered in July 2025 during a security incident in which threat actors maintained persistence for several months, with investigators uncovering a “complex arrangement” of internal web shells that execute commands relayed from persistent malicious processes.

The infection chain includes a loader (Netapi64.dll) and a .NET-based backdoor (OpenAIAgent.Netapi64) that leverage AppDomainManager injection and OpenAI API as a C2 channel to fetch encrypted commands, which are decoded and executed locally before returning results to OpenAI. OpenAI’s Assistants API enables AI-powered agents, and Microsoft notes the API key and associated account were identified and disabled by OpenAI as part of the response.

SesameOp is described as a custom backdoor designed for persistence and long-term access for espionage, with obfuscated DLLs and compromised Visual Studio utilities used to evade detection.