Unit42 uncovers C2Agent: LLM-operated Windows malware abusing victims' own AI tools
cyb3rops · x · 2026-10-13
Palo Alto Networks Unit42 details C2Agent, a new Go-written Windows malware family fully operated by an LLM.
Key points:
- Delivery chain: a stager downloads and injects the implant into Windows shell processes (sihost/RuntimeBroker); the payload URL (agent.x90[.]dev/data/copilot.txt) was still live at posting; C2 traffic mimics the OpenAI API path /v1/chat/completions.
- LLM tool loop: an embedded system prompt casts the implant as an "AI red-team operator" returning one strict JSON tool call per step, running commands, LOLBins, exfiltration, injection, AD recon, and BOFs.
- Living-off-the-AI: abuses the victim's own AI coding CLIs, local model servers, and AI API keys.
- MCP client: defaults to a Firecrawl MCP server for web search/scraping, with more servers pushed at runtime; playbooks/skills are fetched from C2, and the LLM can propose new skills for operator approval.
- The team observed 25 agent builds across 8 versions, first seen 2026-09-10 and still active 2026-10-08.
More from coding & agent
- Daniel Jeffries: only ~2% can actually use AI agents, mass adoption is 10-20 years away — Dan_Jeffries1 · 2026-10-13
- Fully local AI short film mimics Wes Anderson style with a detailed open pipeline — Mist3r-Robot · 2026-10-13
- Controlling his Mac's terminal from a phone via t3 code beta while waiting at speech therapy — NERDDISCO · 2026-10-13
- LLM cache verifier drift: reject-only calibration tripled error rate; 5% audits fix it — Reasonable_Royal_621 · 2026-10-13
- A style guide for making Claude-like models write normally, and its linguistic traps — gleech · 2026-10-13
- Open-source desktop agent dodaios runs local Qwen models via ollama — and shows where 16GB models fail — InternationalGap3698 · 2026-10-13