Exfiltration over C2 is the theft of data through the same command-and-control channel used to manage a compromised system. Instead of opening a separate upload path, the attacker reuses the malware’s remote-control link to send files, screenshots, credentials, or other stolen content back to the operator.
This matters because it blends malicious traffic with ordinary tasking, making detection harder. If defenders only look for obvious data-transfer services or large outbound uploads, they may miss small, encoded chunks moving inside a trusted protocol, broker, or encrypted session. In real attacks, the same channel can carry shell commands, host profiling, and file movement, creating a single pipeline for both control and theft. Defenses focus on context: unusual process behavior, abnormal use of messaging or brokered protocols on non-standard hosts, payload obfuscation, and traffic that does not match the application’s normal function. Monitoring broker logs, endpoint telemetry, and file activity together helps separate legitimate administration from covert exfiltration.