NightshadeC2 Botnet Exploits ‘UAC Prompt Bombing’ to Evade Windows Defender

A new botnet named NightshadeC2 has emerged, identified in August 2025 by eSentire’s Threat Response Unit (TRU) as an evolution in malware evasion. It employs a novel UAC Prompt Bombing technique to force repeated Windows Defender prompts, arguing that the loader executes PowerShell commands to add Defender exclusions for the payload.

NightshadeC2 offers reverse shell access, credential theft, keylogging and remote system control, with a .NET-based loader and a Python variant that appear to use distinct C2 communication paths—ports 7777, 33336, 33337 and 443 for the C version, and TCP port 80 for Python.

Distribution relies on two vectors: ClickFix social engineering and trojanised legitimate software such as Advanced IP Scanner, ExpressVPN, HyperSecure VPN, CCleaner and Everything, each establishing persistence via registry entries including Winlogon, RunOnce and Active Setup. TRU researchers also noted bypass of several sandbox solutions, including Joe Sandbox, CAPEv2, Hatching Triage and Any[.]Run, highlighting the technique’s effectiveness against automated analysis environments.

According to eSentire, the threat supports extensive features like keep-alive, file download/execution, self-deletion, screen capture and clipboard/keyboard harvesting, underscoring the need for multi-layered endpoint security and rigorous user education.