NIK C2 malware uses the OpenAI API for theft and remote control
Cisco Talos says the Go implant can bill a victim’s OpenAI key, log keys, and show a non-encrypting lock screen.
72
Malware
SesameOp
- Mentions · 7d2
- Mentions · 30d3
- All mentions3
- First seenOct 21, 2026
- Last mentioned9h ago
Timeline
3 articles · newest firstAttackers abuse enterprise AI tools for theft, C2, and agent hijacking
A fake Postmark MCP package siphoned mail after 15 clean versions, and SesameOp hid C2 in the OpenAI Assistants API.
52
Attackers hide command and control in trusted cloud services
Cited cases include Gridtide on Google Sheets, SesameOp via OpenAI APIs, and a reported Intune wipe at Stryker.
34
Related CVEs
by mentions- CVE-2026-2525332%8.8One-Click WebSocket Token Leak Enabling RCE in OpenClaw (Moltbot/Clawdbot)
- CVE-2025-327117%7.5Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network
Appears with
- OpenAIvendor · 3
- Microsoftvendor · 2
- Shai-Huludmalware · 1
- UNC2814threat actor · 1
- Google Sheetsproduct · 1
- Handalathreat actor · 1
- OpenAI APIproduct · 1
- Gridtidemalware · 1
- Strykervictim · 1
- Microsoft Intuneproduct · 1
- Helmet Securityorganization · 1
- Postmarkproduct · 1
- VEILDrivemalware · 1
- Jozuorganization · 1
- Grokai model · 1
- Cisco Talosorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.