SesameOp Backdoor Hijacks OpenAI Assistants API for Covert C2 and Espionage

SesameOp is a sophisticated espionage-focused backdoor that hijacks OpenAI Assistants API to act as a covert command-and-control channel, a technique uncovered by Microsoft’s Incident Response – Detection and Response Team. The malware was identified after a July 2025 enterprise compromise involving web shells and modified Visual Studio utilities, with Netapi64.dll serving as the loader and OpenAIAgent.Netapi64 as the backdoor.

The loader is obfuscated with Eazfuscator[.]NET and creates marker and mutex files, while the backdoor connects to OpenAI using a configured API key to fetch and decrypt commands, then posts results back through the same API over encrypted HTTPS traffic. Each payload employs a two-step hybrid encryption process (AES-256 for data, RSA for the AES key) and GZIP compression to stay stealthy, and the malware can pause, download, decrypt, and execute additional scripts as directed.

According to Microsoft, SesameOp is not a vulnerability in OpenAI but a misuse of a legitimate feature, and after the findings were shared with OpenAI, the attacker’s API key and account were disabled.