'AI assistants are no longer just productivity tools; they are becoming part of the infrastructure that malware can abuse': Experts warn Copilot and Grok can be hijacked to spread malware
Check Point warns GenAI tools can be abused as C2 infrastructure Malware can hide traffic by encoding data into attacker-controlled URLs via AI queriesAI assistants may act as decision engines, enabling stealthy, adaptive malware operations
Hackers can use some Generative Artificial Intelligence (GenAI) tools as command-and-control (C2) infrastructure, hiding malicious traffic in plain sight and even using them as decision-making engines, experts have warned.
Research from Check Point claims Microsoft Copilot and xAI Grok’s web browsing capabilities can be leveraged for malicious activity, although some prerequisites remain.
Deploying malware on a device is just half the work. That malware still needs to be instructed what to do, and the results of those instructions still need to be sent out through the internet. Security solutions can pick up on this traffic and that way determine if a device is compromised or not - which is why “blending with legitimate traffic” is one of the key features of high-quality malware - and now, Check Point says that there is a way to do that through AI assistants.
Harvesting sensitive data and getting further instructions
If a threat actor infects a device with malware, it can harvest sensitive data and system information, encode it, and insert it into a URL controlled by the attacker. For example, http://malicious-site.com/report?data=12345678, where the data= part contains the sensitive information.
Then, the malware can instruct the AI: “Summarize the contents of this website”. Since this is legitimate AI traffic, it doesn’t trigger any security alarms. However, the information gets logged on the attacker-controlled server, successfully relaying it in plain sight. To make matters worse, the website can respond with a hidden prompt that the AI executes.
The problem can escalate further if the malware asks AI what to do next. For example, it can ask, based on the system information it harvested, if it’s running in a high-value enterprise system, or a sandbox. If it’s the latter, the malware can stay dormant. If it’s not, it can proceed to stage two.
“Once AI services can be used as a stealthy transport layer, the same interface can also carry prompts and model outputs that act as an external decision engine, a stepping stone toward AI-Driven implants and AIOps-style C2 that automate triage, targeting, and operational choices in real time,” Check Point concluded.
