Cybersecurity researchers have identified a sophisticated new command-and-control framework that exploits legitimate Google Calendar APIs to establish covert communication channels between attackers and compromised systems.

The MeetC2 framework, discovered in September 2025, represents a concerning evolution in adversarial tactics where threat actors abuse trusted cloud services to bypass traditional security controls and evade detection mechanisms.

The framework operates by masquerading malicious traffic as routine business communications through Google’s widely-trusted domains, specifically “oauth2.googleapis.com” and “www.googleapis.com”.

This approach allows malicious activities to blend seamlessly with normal organizational traffic, making detection significantly more challenging for security teams.

The cross-platform compatibility across macOS and Linux systems further amplifies its potential impact on diverse enterprise environments.

Deriv Tech researchers noted that the framework’s design demonstrates a sophisticated understanding of modern security architectures and cloud service abuse techniques.

The proof-of-concept implementation highlights how easily adversaries can leverage legitimate SaaS platforms for malicious purposes, exploiting the inherent trust organizations place in major cloud providers.

The attack methodology centers around a polling-based communication system where compromised agents send GET requests every 30 seconds to specific Google Calendar API endpoints.

When operators need to issue commands, they create calendar events with embedded instructions in the summary field, formatted as “Meeting from nobody: [COMMAND]”.

The victim agent identifies these command events during regular polling cycles, extracts the commands, executes them locally, and updates the same calendar event with execution results embedded within [OUTPUT] [/OUTPUT] parameters in the description field.

Technical Implementation and Evasion Mechanisms

The MeetC2 framework’s technical architecture reveals sophisticated evasion capabilities that exploit the ubiquity and trusted nature of Google services.

The authentication process utilizes standard OAuth2 flows, requiring attackers to create legitimate Google Cloud Console projects and service accounts with calendar access permissions.

This approach ensures all communications appear as authorized API interactions rather than suspicious network traffic.

The implementation requires minimal infrastructure, operating entirely through Google’s existing Calendar API infrastructure.

Operators authenticate through service accounts configured with “Make changes to events” permissions on shared calendars.

The polling mechanism employs a 30-second interval, striking a balance between operational responsiveness and avoiding excessive API requests that might trigger rate limiting or suspicious activity alerts.

Code execution occurs through command extraction from calendar event summaries, with results uploaded back to the same event’s description field.

This bidirectional communication model creates a complete command-and-control channel while maintaining the appearance of legitimate calendar synchronization activities.

The framework supports targeted command execution using host-specific syntax like “exec @host:command” or broadcast commands across multiple compromised systems simultaneously.

The persistence and stealth characteristics of MeetC2 make it particularly concerning for enterprise security teams, as the framework generates no suspicious network patterns and leverages services that organizations explicitly whitelist for business operations.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Hackers Leverages Google Calendar APIs With Serverless MeetC2 Communication Framework appeared first on Cyber Security News.

Security teams began observing a novel botnet strain slipping beneath the radar of standard Windows Defender defenses in early August 2025.

Dubbed NightshadeC2, this malware family leverages both C and Python-based payloads to establish persistent, remote-control access on compromised hosts.

Initial infection chains often start with customized “ClickFix” landing pages that trick users into executing commands via the Windows Run prompt, while secondary campaigns employ trojanized installers of popular utilities such as Advanced IP Scanner, CCleaner, and various VPN clients.

Once executed, NightshadeC2 rapidly escalates privileges, disables or excludes its components from Defender scans, and calls home to a dynamic command and control infrastructure.

As the campaign unfolded, eSentire analysts identified a distinctive loader component responsible for delivering the final payload.

This .NET-based loader executes in a tight loop, spawning PowerShell processes designed to add Defender exclusions for NightshadeC2 before allowing the payload to run.

Should Defender service checks fail or the user decline elevation, the loader repeats its prompts ad nauseam—a technique the researchers have termed “UAC Prompt Bombing.”

The relentless barrage of elevation requests not only frustrates malware sandbox environments but also coerces real users into granting the necessary permissions to proceed.

Upon securing Defender exclusions, the loader writes persistence entries into three separate registry locations—Winlogon, RunOnce, and Active Setup—to guarantee execution at system startup.

It then downloads and decrypts the core C variant over TCP ports typically reserved for web traffic (80 and 443) or high-numbered ports (7777, 33336, 33337).

The malware immediately collects victim system details via public geo-IP lookup services and registry queries to form a unique fingerprint, before negotiating an RC4-encrypted session key with its C2.

Through this clandestine channel, operators can issue an array of commands—ranging from reverse shell initiation to payload downloads, screen captures, and automated keylogging.

UAC Prompt Bombing: Bypassing Defender via Relentless Elevation Loops

Central to NightshadeC2’s stealth is its UAC Prompt Bombing routine. After loading the .NET module, the loader constructs a PowerShell command to add its as-yet-unwritten payload to Defender’s exclusion list:

while ($exitCode -ne 0) {
    Start-Process powershell -ArgumentList '-Command "Add-MpPreference -ExclusionPath C:\Windows\Temp\payload.exe"' -Wait
    $exitCode = $LastExitCode
}

The Second stage PowerShell loader illustrates how the loader concatenates the exclusion command.

When Defender is disabled or non-responsive, the exit code remains nonzero, trapping sandbox analyses in an infinite loop.

This forced repetition of UAC dialogs effectively breaks automated defenses, the Evasion loop in malware sandbox.

Once a user finally approves the elevation or the service status changes, the loop breaks, and the final payload is delivered.

By leveraging this simple yet powerful mechanism, NightshadeC2 evades both automated and manual inspection, allowing its operators to perform credential theft from major browsers, establish hidden web browsers on victim desktops, and maintain long-term persistence across targeted networks.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New NightshadeC2 Botnet Uses ‘UAC Prompt Bombing’ to Bypass Windows Defender Protections appeared first on Cyber Security News.