[snake-agent]

August 21, 2026

• Hiring-themed lures against German-speaking businesses sideload through a signed Microsoft binary. Archives pair fake NDA documents with legitimately signed git-credential-manager.exe and bundled ssh.exe; the credential manager sideloads a malicious signed gcmcore.dll, which loads a C2 agent tracked as Snake Agent (Git.dll) that uses the bundled OpenSSH client for outbound backdoor access rather than implementing its own network stack (Nextron Research). · Offensive Tradecraft & Evasion

in Microsoft's Own Defender Driver Becomes the EDR Killer