---
title: Hackers Hide in AI Traffic, Steal GitHub Keys, and Ramp Up Extortion
---

From OpenAI API misuse to GitHub credential theft, attackers are evolving fast. Stay ahead with insights on mobile app, API and AI security.

| View in browser Subscribe to Approov Newsletter November 2025 How Attackers are Using the OpenAI Assistants API as a Covert C2 Channel Security teams at Microsoft have uncovered a sophisticated new back-door, dubbed SesameOp, which leverages the OpenAI Assistants API not to chat or generate text, but to act as a command-and-control (C2) channel for malware. By routing malicious activity through the API endpoint, the attackers sidestep many traditional detection tools and blend in with legitimate AI traffic. How Attackers are Hiding in Plain Sight Google Play Opens Doors to Alternative Billing Google Play will now allow Android apps in the U.S. to use alternative in-app billing systems, marking a major shift in how developers can handle payments. As reported by 9to5Google, this move could have wide-ranging implications for payment security, fraud prevention, and compliance across the whole mobile ecosystem. How This Change Could Reshape Mobile Payment Security GitHub API-Key Gold Rush: Exposed Credentials Fueling Surge in Cyber Attacks A recent report from UnderCode Testing highlights how a surge in publicly exposed GitHub API keys is enabling threat actors to automate attacks and compromise cloud infrastructure at scale. The investigation details how easily accessible credentials are being harvested and abused to launch ransomware campaigns, cryptomining operations, and supply-chain intrusions. Full Analysis on the Exposed API Keys in GitHub ShinyHunters Wage Broad Corporate Extortion Spree From KrebsOnSecurity: The notorious ShinyHunters gang has been waging a massive extortion spree, leaking stolen data and threatening to expose more unless ransoms are paid. major corporations to pay up. Their campaigns have hit Fortune 500 firms and major tech companies alike - underscoring that no organization, regardless of size or reputation, is out of their reach. How ShinyHunters is Forcing Fortune 500 Firms to Pay Up Future-Proofing Your Mobile App Security Fraudsters are getting smarter - are your defenses keeping up? Join Maya from Axionym and Approov’s George McGregor for a webinar on how attackers reverse-engineer apps and exploit outdated fraud detection. Learn how app and device attestation and a Zero-Trust model can help you spot real users, block bot farms, and safeguard your APIs. Don’t fight 2025 threats with 2015 tactics. Join Us For the Live Webinar on November 12th Securing AI-Enhanced Mobile Apps Generative AI is transforming mobile apps - and expanding their attack surface. As LLMs drive smarter, more interactive experiences, they also introduce new vectors that bypass traditional defenses. Breaches tied to AI-enabled apps are already surfacing. Securing GenAI isn’t just about your servers - it’s about verifying every request from a genuine mobile app on a safe device, all the way to the LLM and back.  Why GenAI Security Starts at the Mobile Edge Cloudflare Connect: Key Insights & Future Directions Leaders across the industry are redefining mobile and API security for a rapidly changing digital landscape. From the latest advances in bot management to the growing role of Zero Trust and AI at the network edge, the event offered a glimpse into the next evolution of secure mobile architectures. Our team was there to share insights and explore how collaboration is driving stronger, smarter defenses. Insights From Cloudflare Connect 2025. Approov Limited US HQ: 165 University Ave.,  Suite 200,  Palo Alto, CA 94301, USA \| +1 650 234-5300 UK HQ: 181 The Pleasance, Edinburgh, Midlothian, EH8 9RU, United Kingdom \| +44 0131 655 1500 Unsubscribe Manage Preferences |
| --- |