SesameOp Backdoor Explained: What You Need to Know About the OpenAI API Exploitation

In July 2025, Microsoft discovered a new backdoor called SesameOp, marking a new stage in cyber-espionage tactics. Unlike typical threats that depend on custom Command and Control (C2) infrastructures, this malware exploited the OpenAI Assistants API to communicate and exfiltrate data from compromised devices.

This blog outlines how SesameOp works, why it represents a shift in attacker behavior, and what steps organizations can take to detect and mitigate similar threats.

SesameOp is a covert backdoor discovered by Microsoft that abuses the OpenAI Assistants API to issue commands, execute payloads, and send results between attackers and compromised devices. It is designed to maintain long-term persistence, leverage legitimate cloud infrastructure for C2 operations, and evade traditional network defenses.

The finding came during an investigation of a months-long breach, where attackers maintained persistence across multiple systems. Notably, Microsoft confirmed the campaign did not involve any OpenAI vulnerability , but instead showed how legitimate APIs can be misused by threat actors for covert operations.

SesameOp’s infection chain involves two main components: a loader named Netapi64.dll and a .NET-based backdoor called OpenAIAgent.Netapi64 . The loader is heavily obfuscated using Eazfuscator.NET, a tool designed to obscure .NET code and hinder reverse engineering.

When executed, the DLL is injected into a host application using a technique known as .NET AppDomainManager injection , directed by a specifically crafted .config file. Once active, the loader establishes a persistence marker and ensures that only one instance of the malware runs at a time.

The core of SesameOp’s functionality lies within OpenAIAgent.Netapi64. Despite its name, it does not use OpenAI’s agent SDKs or model execution features. Instead, it establishes communication through the OpenAI Assistants API , effectively turning a legitimate interface into a covert command channel.

The backdoor retrieves encrypted commands from OpenAI, executes them locally, and sends the results back as messages – wrapped in multiple layers of encryption and compression to stay undetected. This abuse of a trusted cloud API makes traditional network-based detection mechanisms less effective.

The OpenAI Assistants API, originally designed to let developers create custom AI-powered assistants , became the centerpiece of SesameOp’s covert communication channel. Here’s how it worked:

This technique of using public cloud APIs as intermediaries for malware operations allows attackers to bypass many conventional defenses. Security tools configured to trust traffic toward well-known services like OpenAI may inadvertently allow malicious exchanges to occur unnoticed.

Microsoft’s analysis determined that SesameOp was designed for long-term persistence and espionage rather than destructive activity. The attackers sought to quietly monitor and control compromised systems over an extended period.

During the investigation, researchers identified that the malware used multiple compromised Visual Studio utilities to sustain its presence. These utilities were tampered with through malicious library injections, allowing attackers to execute commands internally without relying on external connections.

The attackers demonstrated strong operational security, using encryption , proxy configurations , and mutexes to manage execution. Each compromised host used a unique identifier encoded in Base64 to establish its identity with the OpenAI API, further minimizing detection risks.

Following Microsoft’s findings, OpenAI and Microsoft collaborated to disable the malicious API key and associated account. The investigation confirmed that the account had not interacted with any OpenAI models beyond the API calls used for the backdoor’s C2 operations.

The SesameOp campaign underscores a growing trend in cyber operations: the weaponization of legitimate cloud and AI services . Instead of hosting their own C2 infrastructure, which can be detected, blacklisted, or taken down, threat actors now exploit trusted APIs that organizations commonly whitelist.

This approach poses several challenges for defenders:

The case also highlights the importance of behavioral detection over signature-based methods. While the API calls themselves may appear benign, the context of their use – frequency, structure, and associated process activity – can signal malicious behavior.

Microsoft recommends a series of proactive measures to help organizations detect and prevent similar misuse of legitimate APIs for malicious purposes:

To further enhance cybersecurity readiness, organizations can leverage SOCRadar’s Extended Threat Intelligence (XTI) platform. Our solutions provide continuous visibility into potential exposure points, track emerging threats, and deliver actionable intelligence to proactively defend against advanced attacks like SesameOp.

Full technical analysis and detailed mitigation strategies are available on Microsoft’s official blog .