Trojan in the Code: Tropic Trooper’s Ingenious Hijacking of GitHub and VS Code for Stealthy Espionage

It started with a simple PDF-at least, that’s what the victims thought. But behind the familiar icon and benign appearance lurked one of the most inventive cyber-espionage campaigns seen in recent years. The group known as Tropic Trooper, infamous for targeting East Asian governments and defense sectors, has unveiled a new arsenal: weaponized document readers, custom malware that blends into open-source projects, and a clever abuse of developer tools to slip past even the most vigilant defenders.

The Anatomy of a Covert Operation

On March 12, 2026, security researchers at ThreatLabz uncovered a ZIP archive teeming with military-themed documents in Chinese, including files on nuclear submarines and intelligence operations. The catch? The file “Comparative Analysis of US-UK and US-Australia Nuclear Submarine Cooperation (2025).exe” wasn’t a document at all but a trojanized version of SumatraPDF-the open-source PDF reader-designed to lure unsuspecting users.

Once executed, the seemingly harmless reader displayed a decoy PDF while covertly unleashing a multi-stage infection chain. This chain began with a modified TOSHIS loader, which hijacked the application’s startup process and quietly fetched configuration details, encryption keys, and a secondary payload from a remote staging server. The payload: an AdaptixC2 Beacon, a flexible piece of malware engineered for stealth and control.

Unlike previous attacks that favored widely-detected tools like Cobalt Strike, Tropic Trooper’s latest campaign adopted the open-source AdaptixC2 framework, signaling a shift to more diverse and less conspicuous methods. The Beacon communicated with its operators via GitHub, cleverly using issues and repository files to receive commands and exfiltrate data. Each session generated unique encryption keys, and all traces of communication were deleted from GitHub moments after use, erasing the digital fingerprints before anyone could catch on.

But the innovation didn’t stop there. For high-value victims, the attackers transitioned to using Visual Studio Code tunnels-a legitimate tool for remote development. By installing the VS Code command-line client and establishing persistent tunnels under innocuous-looking task names, the attackers granted themselves interactive, long-term access with minimal risk of discovery. The blending of open-source tools, developer platforms, and rapid artifact cleanup created a nearly invisible backdoor into sensitive systems.

Conclusion: When Offense Looks Like Everyday Software

Tropic Trooper’s campaign is a chilling reminder of how easily trusted software and developer platforms can be weaponized for espionage. By seamlessly integrating malicious code into everyday tools and erasing their tracks in real time, these attackers have raised the bar for stealth and sophistication. As defenders race to adapt, one thing is clear: in the world of cyber-espionage, the greatest threats now hide in plain sight.

WIKICROOK

• Trojanized: Trojanized software appears legitimate but secretly contains malicious code, allowing attackers to compromise systems or steal information without user awareness.
• Loader: A loader is malicious software that installs or runs other malware on an infected system, enabling further cyberattacks or unauthorized access.
• Command: A command is an instruction sent to a device or software, often by a C2 server, directing it to perform specific actions, sometimes for malicious purposes.
• In: An in-app payment system lets users buy digital goods or services directly within an app, offering convenience and more revenue control for developers.
• Persistence: Persistence involves techniques used by malware to survive reboots and stay hidden on systems, often by mimicking legitimate processes or updates.