14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Summary: Trend Micro researchers found trojanized npm packages posing as calendar and streak utilities that drop a Linux backdoor, RedC2 4.0's RedShell beacon, hidden in files named math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, and calc-mapping.bin under dist/. The packages work as advertised, but a single import of dist/index.mjs re-exports the date helpers and launches the bundled implant as a detached background process, with no install hook required. RedC2 4.0 was advertised by a threat actor named MarlboroMan on Hack Forums in early June 2026 and sold for $99.99 through a site branded Red Offsec.
Key Takeaway: The framework ships with Red Agent, an LLM-backed layer that turns natural-language prompts into beacon commands, which Trend Micro says lets operators of varying skill levels run complex, multi-stage intrusions - and the beacon harvests SSH keys and browser credentials once it checks in.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026