14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Summary

Researchers discovered 14 malicious npm packages disguised as calendar and streak utilities. These packages stealthily deliver RedC2 4.0, an AI-powered Linux backdoor, which communicates with a C2 server for post-exploitation activities. The RedC2 framework, marketed by a threat actor named 'MarlboroMan', offers advanced features like terminal access, file transfer, and in-memory execution.

Full text

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 Ravie LakshmananAug 21, 2026Malware / Threat Intelligence Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI, Trend Micro's enterprise cybersecurity business, said in a report published Thursday. "No install hook function call is needed; a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload." The list of identified packages is below - streak-metrics-math@1.0.0,1.0.1 kit-map-vim@1.0.0 streak-map-cache@1.0.0 streak-map-kit@1.0.0 map-streak-kit@1.0.0 streak-cache-map@1.0.0 streak-calc-metrics@1.0.0 streak-calc-math@1.0.0 streak-math-abz@1.0.0 streak-metricsaz@1.0.0 streak-math-metrics@1.0.0 streak-metricazbd@1.0.0 streak-metricsazb@1.0.0 streak-kit-map@1.0.0 What's notable about these packages is that they are functional and offer the promised functionality. But beneath that garb of date utilities is code designed to drop a Linux backdoor by framing it as a native math accelerator. The name of the file varies across the packages: math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, calc-mapping.bin. It's located either directly within the "dist/" or under "dist/internal/,", but what it contains is the same: the RedShell Linux beacon for RedC2 4.0 that communicates with a remote Windows or Linux server to facilitate post-exploitation activities on the compromised host. "Delivery is handled by the package entry file, dist/index.mjs, which acts as a trojan loader," security researcher Aliakbar Zahravi said. "It re-exports the date helpers and launches the bundled implant as soon as the module loads, with no install hook and no exported function required." RedC2 4.0, marketed on cybercrime forums as a cross-platform toolkit for Windows, macOS, and Linux, offers surveillance, credential theft, payload loading, and mass-operation capabilities. The version was advertised by a threat actor named "MarlboroMan" on Hack Forums in early June 2026, describing it as a command-and-control (C2 or C&C) framework "built for evasion." Version 3.0 of RedC2 was sold earlier this January, while version 2.0 was released in August 2025, indicating the framework has been under active development for at least a year. The RedShell Linux beacon was introduced in version 4.0. The C2 framework is also feature-rich, supporting terminal access, file transfer, staged payload delivery, data collection, multi-beacon operation, network visualization, host-to-host tunneling, and in-memory execution of Beacon Object Files (BOFs), .NET assemblies, and shellcode. RedShell Linux execution flow The Linux variant of the beacon, once deployed, provides an interactive shell through "/bin/sh" and exposes Linux-specific commands to enable system discovery, file operations, data collection (e.g., SSH keys and browser credentials), execution, persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting. It also establishes communication with a C2 server and registers the infected system by gathering basic system information and transmitting it in the form of a "check-in message," after which it enters a command-processing loop to process incoming instructions from the operator, execute them via "/bin/sh," and send the results back. The Windows and macOS counterparts cover a similar ground, allowing file operations, host and network reconnaissance, user enumeration, and data harvesting. The Windows beacon also incorporates User Account Control (UAC) bypass, antivirus and endpoint detection, antivirus tampering, in-memory execution, and lateral movement that the macOS version lacks. On a clearnet website branded Red Offsec, the threat actor claims, "Red C2 is a multi-language, multi-OS command and control framework designed for Windows, Linux, and macOS. The entire framework was built with evasion as a core principle, utilizing the latest developments and techniques in the offensive security field." It's available for purchase for $99.99. Red Offsec's Terms of Service expressly prohibit its customers from using the tool for "unauthorized computer access," "hacking without explicit permission," and "abuse, exploitation, or damage of systems you do not own or are not authorized to test." "Red Offsec provides tools intended for red team professionals and users who understand external offensive security tooling within legal and ethical boundaries," the terms read. RedC2 extends its control layer with a command-line extension referred to as RedC2 EXT as well as a large language model (LLM)-driven component called Red Agent, the latter of which lets operators orchestrate complex post-exploitation tasks, such as network reconnaissance and credential dumping, using natural language commands. "RedC2 ships with an AI assistant called Red Agent, an LLM-backed command execution layer that turns natural-language intent into framework beacon commands," Zahravi said. Red Offsec has characterized it as an "AI-powered command execution system specialized for penetration testing." The findings underscore how previously undocumented AI-integrated C2 frameworks are being distributed via malicious npm packages, while simultaneously lowering the barrier to entry. "By interacting with a model tuned for red-team operations, an operator inputs natural-language prompts, and the framework translates them into actionable command sequences," TrendAI said. "This abstraction lets operators of varying skill levels execute complex, multi-stage intrusions efficiently." The development comes close on the heels of a coordinated supply chain attack affecting three legitimate Rust crates (arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9), compromising them with a malicious proc-macro1 dependency that executed cross-platform malware automatically during Cargo builds. The malware is designed to profile the infected device, catalog Chromium-based browsers, establish persistence, and beacon to attacker-controlled infrastructure for tasking and downloading additional payloads. It's suspected that the maintainer's publishing credentials were compromised to push the poisoned versions to the package repository. Evidence points to infrastructure overlaps with prior software supply chain attacks targeting Mastra and Axios, both linked to North Korean threat actors. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  AI Security, Credential Theft, Cybercrime, Developer Security, linux, Malware, network security, Open Source, Software Supply Chain, Threat Intelligence ⚡ Top Stories This Week Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Over 250 ClickFix Domains

Indicators of Compromise

• malware — RedC2 4.0
• malware — RedShell Linux beacon

Entities