Tropic Trooper used trojanized SumatraPDF and GitHub C2 in 2024 to deploy AdaptixC2, enabling covert VS Code tunnel access.
Finding hijacked subdomains is straightforward. People need only enter site: [university].edu “xxx” or site: [university].edu ...
Danquah, P. and Bekoe, S. (2026) Cyber Deception and Theft: A Critical Review. Journal of Information Security, 17, 149-166.