AI Assistants Used as Covert Command-and-Control Relays

Check Point Research demonstrates a proof-of-concept where web-capable AI assistants are repurposed as covert C2 proxies: malware can have the AI fetch attacker-controlled pages, embed commands in the AI's response, and receive instructions without API keys or accounts. The report highlights automation via a WebView2-based implant and warns of future AI-enabled malware that uses models for runtime decision-making to refine reconnaissance, evade sandboxes, and exfiltrate high-value data selectively.