14 Trojanized npm Packages Deploy the AI-Controlled Linux Backdoor RedC2 4.0

Trend Micro's TrendAI unit has reported the discovery of 14 malicious packages in the npm registry. On the surface they look like working tools for handling dates and counting “streaks,” and they do deliver the advertised functionality — but hidden beneath that shell is a loader for a Linux backdoor.

How the infection works

The danger lies in the delivery mechanism. According to the researchers, the entry point is the file dist/index.mjs, which re-exports harmless date helpers while also locating a bundled binary, marking it executable and launching it as a detached background process. No install hooks or explicit function call are required: a single import anywhere in the dependency graph — even a transitive one — is enough to set the code off.

The binary disguises itself as a “native math accelerator” and goes by different names across the packages (math-core.bin, calc.bin, calc-cache.bin and others), but the contents are identical — a RedShell beacon for the RedC2 4.0 framework. It connects to a remote Windows or Linux server and enables post-exploitation on the infected machine.

What RedC2 4.0 can do

RedC2 is sold on cybercriminal forums as a cross-platform kit for Windows, macOS and Linux. An actor going by the handle MarlboroMan announced version 4.0 on Hack Forums in early June 2026, calling the framework “built to evade defenses.” Judging by its release history (version 2.0 in August 2025, 3.0 in January), the project has been in development for at least a year; it was in 4.0 that the RedShell Linux beacon appeared.

The Linux variant opens an interactive shell via /bin/sh, conducts system reconnaissance, steals data (including SSH keys and browser credentials), provides persistence, in-memory ELF execution, SOCKS5 proxying and network pivoting. The Windows version can additionally bypass UAC and silence antivirus software.

AI lowers the barrier to entry

A distinctive feature of RedC2 is Red Agent, a component built on a large language model. It translates natural-language commands into sequences of framework actions, allowing operators of varying skill levels to carry out complex, multi-stage attacks. On the “legitimate” Red Offsec site the tool is offered for $99.99 and, of course, comes with terms prohibiting unauthorized access — a caveat that, on cybercriminal forums, sounds more like a formality.

The researchers stress a troubling trend: previously unknown C2 frameworks with built-in AI are now being distributed through malicious npm packages while simultaneously lowering the barrier to entry for attackers. In parallel, a similar incident was recorded in the Rust ecosystem: three legitimate crates were compromised through a malicious dependency that triggered right during the Cargo build.

Source: The Hacker News