Trojanized npm packages posing as utilities can silently deploy RedShell, the Linux implant for RedC2 4.0. A single import triggers AI-assisted C2 execution. #RedC2 #RedShell #RedOffsec
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Researchers found trojanized npm packages that pretend to be calendar and streak utilities while secretly deploying RedC2 4.0’s AI-powered Linux implant, RedShell. The campaign uses a simple import to trigger execution and is linked to a broader, evolving C2 framework promoted by the threat actor MarlboroMan via Red Offsec. #RedC2 #RedShell...
www.hendryadrian.com
August 22, 2026 at 5:45 AM
Trojanized npm packages posing as utilities can silently deploy RedShell, the Linux implant for RedC2 4.0. A single import triggers AI-assisted C2 execution. #RedC2 #RedShell #RedOffsec