Loading story…
AdaptixC2, an open-source post-exploitation framework, has been increasingly leveraged by threat actors for sophisticated cyberattacks. Security researchers discovered that AdaptixC2 was distributed through a malicious npm package named 'https-proxy-utils,' which masqueraded as a legitimate HTTPS proxy utility. This package, now removed from the npm registry, contained a post-install script that downloaded and executed the AdaptixC2 agent, adapting its installation method based on the victim's operating system and architecture. On Windows, the agent was executed via DLL sideloading into msdtc.exe, while on macOS, it was installed as an executable with a plist autorun configuration, and on Linux, it was placed in the /tmp/.fonts-unix directory with execute permissions. The malicious package mimicked legitimate proxy packages with millions of weekly downloads, increasing the likelihood of accidental installation by unsuspecting developers. AdaptixC2 provides a comprehensive suite of command-and-control features, including beaconing, command execution, file management, data exfiltration, credential harvesting, lateral movement, and custom payload deployment through modular plugins called 'extenders.' Researchers have also observed AdaptixC2 being deployed via social engineering attacks, such as impersonating help desk staff on Microsoft Teams, and through AI-generated PowerShell scripts that enable fileless execution and persistence via DLL hijacking and registry run keys. The framework's encrypted configuration, stored in the PE file’s .rdata section and protected with RC4 encryption, poses challenges for defenders but can be analyzed with specialized tools. Recent incidents have linked AdaptixC2 to attacks on financial institutions in Asia, where it was used in conjunction with Fog ransomware, highlighting its role in multifaceted campaigns. The framework's support for SOCKS4/5 proxies and port forwarding enables covert network communication, further complicating detection. Its modular architecture allows attackers to tailor payloads and evasion techniques to specific environments, making it a significant threat to organizations. AdaptixC2's low profile and customizable features have contributed to its growing popularity among both penetration testers and malicious actors. Security teams are urged to strengthen defenses against such advanced post-exploitation tools, as their evolving tactics can bypass traditional security measures. The discovery of AdaptixC2 in a widely used software supply chain underscores the ongoing risks posed by malicious packages in open-source ecosystems. Organizations should monitor for suspicious npm packages and implement robust endpoint detection to mitigate the threat posed by frameworks like AdaptixC2. The incident demonstrates the increasing sophistication of supply chain attacks and the need for vigilance in software dependency management.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
SC Media reported that AdaptixC2 was being distributed through a malicious npm package, adding a specific delivery mechanism to the public understanding of the campaign. With no earlier date stated in the reference, the publication date is used.
PolySwarm published research on AdaptixC2, documenting the malware/campaign as a notable security development. The reference does not provide earlier incident dates, so the publication date is used as the event date.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Unit 42 researchers observed multiple real-world attacks in May 2025 involving the AdaptixC2 post-exploitation framework. Threat actors gained initial access through Microsoft Teams phishing and deployed AdaptixC2 beacons using PowerShell loaders, including AI-generated scripts with advanced persistence techniques. The framework's modularity, fileless execution, and support for custom payloads make it a growing threat, with evidence of use alongside ransomware such as Fog.
Jun 29, 2026
Security researchers from Silent Push have identified that the open-source command and control (C2) framework AdaptixC2, originally designed for penetration testing and adversary emulation, is being actively abused by Russian-linked cybercriminals. The tool, which is freely available on GitHub and supports Linux, Windows, and macOS, has been leveraged to deliver malicious payloads in global ransomware campaigns. The investigation into AdaptixC2's misuse began during research into the CountLoader malware loader, where AdaptixC2 was observed being used to deploy additional threats, including ransomware and information stealers. Further analysis revealed that a threat actor known as “RalfHacker” is likely the developer behind AdaptixC2 and operates a Russian-language Telegram channel to promote and sell the tool within the criminal underground. The cross-platform nature and extensibility of AdaptixC2 make it attractive for both legitimate security testing and malicious activity, enabling attackers to target a wide range of systems. Security teams have responded by developing detection signatures for both CountLoader and AdaptixC2 infrastructure to help mitigate the threat posed by this dual-use tool.
Jun 29, 2026
Attackers are increasingly leveraging both social media platforms and software supply chains to distribute malware and post-exploitation frameworks. On TikTok, a video with over 500 likes was discovered promoting a method to illegally activate Photoshop, which in reality instructs users to run a PowerShell command as an administrator. This command fetches and executes malicious PowerShell code from a remote server, with the code identified by a specific SHA256 hash and flagged by multiple antivirus engines. The script then downloads a secondary payload, updater.exe, which is identified as the AuroStealer malware. Persistence is achieved by creating a scheduled task under various plausible system task names, ensuring the malware runs at user logon. The scheduled task is configured to run with the highest privileges and is designed to evade user detection by running in hidden mode. The AuroStealer component is capable of stealing sensitive information from the infected system, posing a significant risk to victims who follow the TikTok video's instructions. Separately, the npm ecosystem was found to be hosting a malicious package named https-proxy-utils, which masqueraded as a legitimate proxy utility. This package cloned functionality from popular proxy packages to appear trustworthy, but included a post-install script that downloaded and executed the AdaptixC2 agent, a post-exploitation framework similar to Cobalt Strike. The malicious npm package was designed to target multiple operating systems, with OS-specific payload delivery mechanisms for Windows, Linux, and macOS. On Windows, the agent was dropped as a DLL in the system directory and executed via DLL sideloading using a copied legitimate executable. On macOS, the payload was placed in the user's autorun directory with a corresponding plist file to ensure persistence. The npm package was quickly removed after discovery, but its presence highlights the ongoing risks in open-source software repositories. Both incidents demonstrate the evolving tactics of threat actors, who exploit both user trust in social media and the software supply chain to deliver sophisticated malware. The use of social engineering on platforms like TikTok lowers the barrier for infection by convincing users to execute malicious commands themselves. Meanwhile, the abuse of npm packages shows how attackers can reach a wide audience of developers and users by mimicking legitimate software. These campaigns underscore the importance of user education, vigilant monitoring of software dependencies, and robust endpoint protection to mitigate the risk of malware infections. Organizations should be aware of these attack vectors and implement controls to prevent the execution of unauthorized scripts and the installation of unverified software. The convergence of social engineering and supply chain attacks represents a significant challenge for defenders, requiring a multi-layered security approach.
Jun 29, 2026