Exfiltration over a command-and-control (C2) channel means stolen data is sent out through the same communications path an attacker uses to control malware or a compromised host. Instead of copying files to an obvious upload site, the malware embeds or streams data inside beaconing traffic, DNS queries, HTTPS sessions, or other covert messages that already look like legitimate remote administration.
This matters because C2 traffic is often allowed through firewalls, proxies, and network monitors, making the theft harder to spot. In real attacks, operators may stage files, compress or encrypt them, and drip them out in small chunks to avoid detection. Defenders look for unusual outbound destinations, irregular beacon sizes, data spikes, domain fronting, and mismatches between process behavior and network use. Network detection, egress filtering, and DLP can help, but only if teams inspect C2 channels as potential data theft paths, not just malware control links.