October 13, 2026
- C2Agent is described by Unit 42 as LLM-operated Windows malware with MCP support and a "skills" system that abuses the victim's own AI coding tools for post-exploitation — "living off the AI". Its payload URL,
agent.x90[.]dev/data/copilot.txt, was still live at the time of posting (@Unit42_Intel). · AI-Enabled Attacks