PATCHCORD: The Campaign Hiding a Backdoor in Browsers and Using Google Sheets as C2

Fake Telecom Tools Target Strategic Organizations

A cyberespionage campaign is targeting Afghan telecom operators and organizations linked to critical infrastructure across South Asia. The activity was disclosed on August 16, 2026, and uses fake VPN installers, telecom management software, and portals designed to imitate legitimate services.

The primary malware is PATCHCORD, a backdoor developed in C/C++ for 64-bit Windows systems. The attackers created highly targeted lures for the affected sectors, including fake installers associated with Afghan Telecom (AFTEL) and tools intended for telecommunications providers.

In one case, the program replicated the company name, product fields, and even the URL of the genuine support portal. After launch, the installer executed the malware while simultaneously opening a normal browser session, reducing visible signs for the user.

The campaign also includes a domain impersonating the identity of India’s National Informatics Centre (NIC). The exact installer versions and imitated products have not been disclosed.

Browser Hijacking Provides Persistence

PATCHCORD first checks whether elevated privileges are available. It then searches for the shortcuts used to launch Microsoft Edge, Google Chrome, and Mozilla Firefox.

The malware preserves the original shortcuts and modifies them so that, whenever they are opened, the backdoor runs before the legitimate browser. From the user’s perspective, behavior remains unchanged: they click the familiar icon and see the browser open normally, while the malicious code runs in the background.

This technique provides the attacker with stealthy persistence without necessarily adding services or scheduled tasks that can be easily detected. Remote management of this configuration is one of the backdoor’s capabilities.

Once active, PATCHCORD communicates with its command-and-control server and can at least:

• modify the interval between communications;
• enumerate running processes;
• execute shellcode directly in memory;
• launch arbitrary commands through a hidden shell;
• remotely modify browser shortcut-based persistence.

In-memory execution can leave fewer traces on disk, complicating subsequent forensic investigations. However, it does not prevent the detection of anomalies in processes, shortcuts, or endpoint-generated traffic.

SHEETCORD Moves Command and Control to Google

Infrastructure analysis led to the identification of SHEETCORD, a second malware written in Go. Its code combines characteristics previously observed in SHEETCREEP RAT with capabilities found in PATCHCORD, suggesting the operator’s tooling has evolved over time.

The most significant difference concerns the C2 channel. SHEETCORD does not use a traditional web server, but the Google Sheets API. A separate sheet is created for each victim within a spreadsheet, turning the document into a channel for exchanging commands and responses.

This approach abuses a cloud service commonly used on corporate networks. As a result, broadly blocking traffic to Google may be impractical, while malicious activity can blend in with normal business operations.

SHEETCORD retains a remote execution function called main.executeShellCommand, similar to the one in PATCHCORD. However, it uses a different method to launch commands: instead of cmd.exe /c, the malware invokes:

powershell -Command

Execution is wrapped in a script block, increasing its overlap with standard Windows administration tools and reflecting the technical evolution of the toolchain.

GitHub Gists and AI-Assisted Development

A third family identified in the operation is HACKERAI C2 Agent, which uses GitHub Gists for command and control.

The code contains debug messages, comments consistent with code generated by artificial intelligence tools, and redundant implementations. Researchers also identified a duplicated XOR routine that reuses the same key.

These elements suggest at least partial use of coding tools assisted by large language models. They do not, however, indicate an operation conducted autonomously by an AI system. The suspected role is primarily code generation or assembly, rather than independent campaign planning.

The use of legitimate services such as Google Sheets and GitHub Gists makes controls based solely on address reputation or domain blocking less effective. Detection must therefore also consider context: which process is accessing the API, from which endpoint, and how frequently.

A Staging Server Exposes the Entire Toolkit

The investigation was aided by the discovery of a staging server that was accessible without adequate protection. The system contained numerous components of the operational arsenal, including SuperShell, a Chinese-language C2 framework, several remote access trojans, and credential-stealing tools.

The server also contained exploits for a known OpenSSH vulnerability and files apparently consistent with a database containing the call history of iOS devices. The latter artifact suggests the possibility of activity aimed at acquiring mobile data, but does not by itself prove that such information was actually stolen.

The infrastructure was still active when the findings were published. Domains changed regularly, while the underlying server remained unchanged for months. No specific domains, IP addresses, hashes, or other technical indicators were disclosed.

Attribution to APT36, also known as Transparent Tribe, remains moderate-confidence. Supporting elements include credential-harvesting tools previously associated with confirmed campaigns, a C2 framework separately attributed to the same group, and the use of Google Sheets in earlier activity linked to APT36.

No single clue is considered conclusive. Taken together, however, the evidence is consistent with a group known to target Indian government and defense organizations.

Implications and Recommended Checks

Potential targets include Afghan telecommunications providers, regional critical infrastructure, government agencies, defense organizations, and energy infrastructure across South Asia.

The observed capabilities enable command execution, process discovery, browser persistence, and operations through normally authorized cloud services. This places data, credentials, and internal systems at risk, with potential consequences for confidentiality, integrity, and availability.

Organizations should:

• verify VPN installers and telecom tools even when their branding, names, and URLs appear authentic;
• compare Edge, Chrome, and Firefox shortcuts with known-good versions;
• look for unusual backups or additional parameters in shortcut targets;
• monitor PowerShell using -Command and script blocks launched by unexpected processes;
• analyze access to the Google Sheets API and GitHub Gists from endpoints that do not normally use them;
• identify shellcode executed in memory and anomalous browser child processes;
• monitor connections to newly registered or frequently changing domains;
• isolate suspicious hosts and capture volatile memory before remediation;
• rotate potentially exposed credentials and review access to cloud, telecom, and government systems.

No specific patches or removal utilities are currently indicated for PATCHCORD, SHEETCORD, or HACKERAI C2 Agent. Staff training should also cover customized sector-specific lures, not just obviously suspicious links.

Separate Entry on CVE-2026-58231

The CVE-2026-58231 vulnerability affects SAP Commerce Cloud and is unrelated to the PATCHCORD campaign and APT36.

The flaw has a CVSS score of 10 and the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

It is classified as CWE-94. An unauthenticated attacker can abuse a default authentication client and send crafted input to specific functions that lack sufficient validation. Exploitation can lead to arbitrary code execution and compromise of internal application components.

The affected versions have not been disclosed. It is also unclear whether CVE-2026-58231 appears in the CISA KEV catalog, and no associated remediation deadline has been provided.