Post-Exploitation Framework AdaptixC2 Exposed Through Malicious npm Package

Incident Overview

The AdaptixC2 post-exploitation framework, positioned as a potential replacement for the renowned Cobalt Strike, first entered public view in early 2025. By spring of that same year, security analysts recorded its usage in malicious activities, highlighting rising cybersecurity threats.

In October 2025, researchers from Kaspersky identified a malicious package named https-proxy-utils within the npm (Node Package Manager) ecosystem. This package deceptively claimed to provide utility functions for proxy management within applications, yet disguised a significant security risk. The authors of the malicious package had swiftly retracted it following the revelation, but the damage had already been done.

With a name strikingly similar to legitimate and widely-used packages—including http-proxy-agent and https-proxy-agent, which see weekly download counts of approximately 70 million and 90 million respectively—the threat level was heightened. The malicious package also mirrored the functionalities of proxy-from-env, a package used by millions. Embedding a post-install script, https-proxy-utils orchestrated the download and execution of the AdaptixC2 agent, allowing attackers to gain a foothold in targeted environments.

Metadata comparison of the malicious (left) and legitimate (right) packages

Cross-Platform Mechanism

The adaptability of the script is particularly concerning, as it includes delivery methods for all major operating systems: Windows, macOS, and Linux. Each environment sees specific payload delivery techniques that leverage system or user directory structures for execution.

On Windows systems, the AdaptixC2 agent is slyly implanted as a DLL file within the system directory located at C:\Windows\Tasks. Utilizing DLL sideloading, the attacker executes the method by copying a legitimate executable, msdtc.exe, and using it to load the malicious DLL. This trademark technique of masquerading legitimate files heightens the threat landscape tremendously.

Deobfuscated code specific to Windows for loading the AdaptixC2 agent

In the macOS environment, the framework's installation process is slightly different. The payload is downloaded as an executable and placed within the user’s autorun directory: Library/LaunchAgents. Here, the postinstall.js script also creates a plist file to ensure the proper configuration for autorun functionalities. The initial architecture check, whether x64 or ARM, adds an extra layer of sophistication, allowing attackers to tailor the malicious payload accordingly.

Deobfuscated macOS-specific code for coordinating AdaptixC2 execution

Linux deployments face a similar fate, where the payload is downloaded into the temporary directory /tmp/.fonts-unix. Here, the script dispatches architecture-specific binaries and assigns execute permissions, paving the way for malicious activities.

Code specific to Linux environments for loading the AdaptixC2 agent

Once the AdaptixC2 agent is firmly established on an infected device, it unlocks a range of functionalities for attackers, including persistent remote access, command execution, file manipulation, and process management. This extensive control empowers threat actors to blend into the environment, conduct reconnaissance, and orchestrate additional stages of a potential attack.

Broader Implications

The surge of malicious activities targeting npm packages isn't unprecedented. Similar tactics recently emerged in the notable Shai-Hulud worm incident, which compromised more than 500 packages utilizing post-installation scripts. The AdaptixC2 incident underscores a troubling pattern of exploiting the open-source software model, with malicious actors actively weaponizing public repositories for distribution.

Organizations using open-source modules are potentially at risk, making vigilance paramount. Rigorous scrutiny of newly introduced packages, particularly from less established repositories, is crucial. Even well-known modules should be monitored for potential irregularities in development, as malicious scripts can be cleverly embedded in otherwise legitimate-looking packages.

To mitigate risks, developers should consult regularly updated feeds about compromised packages and maintain a habit of verifying module names before installation. This proactive approach could significantly reduce exposure to similar threats in the future.

Indicators of Compromise

Malicious Package Name
https-proxy-utils

Hashes
DFBC0606E16A89D980C9B674385B448E, B8E27A88730B124868C1390F3BC42709, 669BDBEF9E92C3526302CA37DC48D21F, EDAC632C9B9FF2A2DA0EACAAB63627F4, 764C9E6B6F38DF11DC752CB071AE26F9, 04931B7DFD123E6026B460D87D842897

Network Indicators
cloudcenter[.]top/sys/update, cloudcenter[.]top/macos_update_arm, cloudcenter[.]top/macos_update_x64, cloudcenter[.]top/macosUpdate[.]plist, cloudcenter[.]top/linux_update_x64, cloudcenter[.]top/linux_update_arm