StopAndProtect SimpleChatProxy execution with attacker image-endpoint C2

Duo Tech@duotech

•updated Aug 18, 2026•0•0•1

Detects execution of the SimpleChatProxy/'Chat Proxy' tool correlated with outbound traffic to an attacker-hosted image endpoint, used for operator-victim messaging and remote screenshot retrieval.