How Attackers are Using the OpenAI Assistants API as a Covert C2 Channel
Security teams at Microsoft have uncovered a sophisticated new back-door, dubbed SesameOp, which leverages the OpenAI Assistants API not to chat or generate text, but to act as a command-and-control (C2) channel for malware. By routing malicious activity through the API endpoint, the attackers sidestep many traditional detection tools and blend in with legitimate AI traffic.
Google Play will now allow Android apps in the U.S. to use alternative in-app billing systems, marking a major shift in how developers can handle payments. As reported by 9to5Google, this move could have wide-ranging implications for payment security, fraud prevention, and compliance across the whole mobile ecosystem.
A recent report from UnderCode Testing highlights how a surge in publicly exposed GitHub API keys is enabling threat actors to automate attacks and compromise cloud infrastructure at scale. The investigation details how easily accessible credentials are being harvested and abused to launch ransomware campaigns, cryptomining operations, and supply-chain intrusions.
From KrebsOnSecurity: The notorious ShinyHunters gang has been waging a massive extortion spree, leaking stolen data and threatening to expose more unless ransoms are paid. major corporations to pay up. Their campaigns have hit Fortune 500 firms and major tech companies alike - underscoring that no organization, regardless of size or reputation, is out of their reach.
Fraudsters are getting smarter - are your defenses keeping up? Join Maya from Axionym and Approov’s George McGregor for a webinar on how attackers reverse-engineer apps and exploit outdated fraud detection. Learn how app and device attestation and a Zero-Trust model can help you spot real users, block bot farms, and safeguard your APIs. Don’t fight 2025 threats with 2015 tactics.
Generative AI is transforming mobile apps - and expanding their attack surface. As LLMs drive smarter, more interactive experiences, they also introduce new vectors that bypass traditional defenses. Breaches tied to AI-enabled apps are already surfacing. Securing GenAI isn’t just about your servers - it’s about verifying every request from a genuine mobile app on a safe device, all the way to the LLM and back.
Leaders across the industry are redefining mobile and API security for a rapidly changing digital landscape. From the latest advances in bot management to the growing role of Zero Trust and AI at the network edge, the event offered a glimpse into the next evolution of secure mobile architectures. Our team was there to share insights and explore how collaboration is driving stronger, smarter defenses.
