Reported by 2 outlets

Timeline

1. update from cyberpress.org

   C2Looper Backdoor Uses GitHub C2 and Shellcode Injection to Establish Ransomware Footholds

   cyberpress.org · 56d ago · August 18th, 2026

   The malware was discovered in July 2026 and is likely used by a ransomware-related threat actor to gain an initial foothold, perform reconnaissance, move laterally, and deploy additional payloads. Researchers assess with low to medium confidence that C2Looper is delivered through multi-stage ClickFix infection chains. ClickFix attacks commonly trick victims into running malicious commands or files by presenting fake verification prompts, software errors, or CAPTCHA-style instructions . C2Looper provides attackers with a standard but effective set of backdoor functions. It can execute remote commands, gather system information, download additional files, and launch second-stage malware. Its latest version adds GitHub-based command-and-control communications and shellcode injection, indicating that its developers are actively improving the malware. The malware also uses basic defense-evasion methods. It encrypts embedded strings using an XOR operation with an eight-byte key and resolves Windows APIs dynamically through LoadLibrary and GetProcAddress. This makes static analysis more difficult because important functions and strings are not immediately visible in the binary. C2Looper Establishes Ransomware Footholds Older C2Looper samples communicate with a command-and-control server through plaintext HTTP. After execution, the malware collects the username, DNS hostname , process ID, and a bot identifier created from the hostname and username. It sends this information as a JSON

2. update from gbhackers.com

   C2Looper v2 Uses GitHub Repositories as Full Command-and-Control Infrastructure.

   gbhackers.com · 56d ago · August 18th, 2026

   A newer build, internally identified as version 2, replaces conventional command-and-control infrastructure with GitHub repositories used to deliver tasks, receive results, maintain beacon records, and host payloads. appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .