SesameOp Exploits OpenAI API for Command and Control Backdoor

Basio badr

ago 5 hours

SesameOp Exploits OpenAI API for Command and Control Backdoor

Recent research by the Detection and Response Team (DART) at Microsoft revealed a sophisticated backdoor malware named SesameOp. This threat is characterized by its unconventional usage of the OpenAI Assistants API for command-and-control (C2) communications. Discovered in July 2025, SesameOp allows threat actors to maintain a persistent and clandestine presence within affected environments.

Key Features of SesameOp

Rather than relying on traditional communication techniques, SesameOp utilizes the OpenAI API to covertly relay commands and execute malicious activities. This approach represents an innovative method for managing compromised systems with minimal exposure.

Technical Aspects

The malware exploits Windows-based applications, specifically using a loader named Netapi64.dll and a .NET-based backdoor called OpenAIAgent.Netapi64. This backdoor is particularly noteworthy for its ability to broker communications with the OpenAI Assistants API, using it for both command fetching and result reporting.

Infection Chain

Loader: Netapi64.dll – responsible for injecting the backdoor into targeted systems.
Backdoor: OpenAIAgent.Netapi64 – executes commands fetched from the OpenAI API.

The loader is designed to be stealthy. It uses techniques like obfuscation and compression, ensuring that malicious activities remain hidden from detection systems.

Operational Mechanisms

Upon execution, SesameOp initializes its settings using a .NET resource file and communicates with the OpenAI API to manage commands. This includes fetching and executing payloads that are encrypted and compressed to evade detection.

Data Handling

SesameOp implements a sophisticated method of communicating with the OpenAI API:

It queries for a list of Assistants, retrieves commands, and executes these instructions.
Results from executed commands are sent back to the OpenAI platform, utilizing secure and compressed formats.

Mitigation Strategies

To counteract threats like SesameOp, organizations should adopt several proactive measures:

Regularly audit firewalls and server logs.
Utilize advanced firewall protections to block unwanted communications.
Enable tamper protection in security software.
Use real-time protection features to catch emerging threats swiftly.

This situation emphasizes the importance of vigilance in cybersecurity. With tools like OpenAI being misused, understanding and addressing the evolving tactics of threat actors must be a priority for organizations globally.

Future Developments

Microsoft continues to collaborate with OpenAI to better comprehend and mitigate the risks associated with misuse of emerging technologies. As the situation evolves, both companies aim to enhance security defenses to combat threats like SesameOp effectively.