Non-Browser Process Querying AI LLM API Endpoints (PROMPTFLUX T1567/T1102)

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•2

Detects DNS resolutions for major AI/LLM provider domains (e.g., OpenAI, Anthropic, Google AI) originating from processes that are not common, known browsers or development tools. This behavior is indicative of potentially malicious applications or malware using AI APIs for automated tasks, such as content exfiltration or sophisticated C2 communication.