← Back to feed
2026-10-18 MalwareMcp Security TLP:CLEAR

Unit 42 Documents C2Agent, LLM Operated Windows Malware That Lives Off Victim AI Coding Tools

Date: 2026-10-18
Tags: malware, mcp-security

Executive Summary

Unit 42 documented C2Agent, Windows malware operated by an LLM that drives post exploitation through MCP and the victim's own installed AI coding tools, an approach described as living off the AI. Its payload was served from agent.x90.dev/data/copilot.txt, which kyber.today reported was still live at the time of posting. Defenders should monitor MCP server activity and execution tied to locally installed AI coding assistants.

Campaign Summary

FieldDetail
Campaign / MalwareC2Agent
AttributionUnknown (confidence: none)
TargetWindows endpoints with AI coding tools installed
VectorDownloaded payload that abuses MCP and local AI coding tools for command and control
Statusactive
First Observed2026-10-13

Detailed Findings

According to kyber.today, Unit 42 documented C2Agent as Windows malware operated by an LLM that drives post exploitation through the Model Context Protocol and the victim's own installed AI coding tools, an approach the report calls living off the AI. C2Agent ships with MCP support and a skills system that abuses those local AI coding tools for post exploitation. kyber.today reported that the payload URL agent.x90.dev/data/copilot.txt was still live at the time of posting, citing Unit 42 Intel. Because C2Agent reuses legitimate, locally installed developer tooling, detection depends on watching MCP server creation and AI tool child processes rather than on host artifacts from a dedicated implant.

MITRE ATT&CK Mapping

TechniqueIDContext
Application Layer ProtocolT1071Command and control and tasking are driven over MCP and the victim's AI coding tool interfaces instead of a dedicated implant channel.

IOCs

Domains

agent.x90.dev

Full URL Paths

https://agent.x90.dev/data/copilot.txt

Splunk Format

"agent.x90.dev" OR "https://agent.x90.dev/data/copilot.txt"

Affected Platforms

Windows

Detection Recommendations

Monitor outbound connections to agent.x90.dev and similar C2 endpoints, and block the known payload path. Alert on MCP server creation and tool invocation that the user did not initiate, and watch for child processes spawned by installed AI coding assistants. Treat downloads of files named copilot.txt from non vendor hosts as suspicious.

References