As reported by The Hacker News, cybersecurity researchers have revealed a novel attack method where artificial intelligence assistants with web browsing capabilities can be repurposed as covert command-and-control (C2) relays, potentially allowing attackers to mask their activities within legitimate enterprise communications and evade detection.
This technique, dubbed "AI as a C2 proxy" by Check Point, has been demonstrated against AI tools like Microsoft Copilot and xAI's Grok. It exploits the AI's web browsing and summarization features to retrieve attacker-controlled URLs and relay commands back to compromised machines. The method bypasses traditional security measures as it does not require API keys or registered accounts.
This approach is similar to "living off trusted sites" (LOTS) attacks, weaponizing AI services as a stealthy transport layer for C2 communications and data exfiltration. The attackers may also use AI assistance to automate reconnaissance, script malicious actions, and dynamically adapt their intrusion strategies.
Source: The Hacker News
