## 8 Related Work
Beyond direct data exfiltration, adversaries have also manipulated browser components such as DNS and WebRTC requests to tunnel sensitive information outside monitored networks, effectively bypassing traditional network security mechanisms [23]. To further evade detection, researchers have explored various obfuscation techniques, including encoding stolen data within images, encrypting payloads, or embedding information within seemingly benign web traffic. Such approaches significantly complicate detection by security tools reliant on behavior-based anomaly detection and browser sandboxing [19]. The effectiveness of these attacks depends on the ability to bypass security measures such as CSPs, browser sandboxing, and real-time traffic analysis. To our knowledge, the Earth Kitsune Advanced Persistent Threat (APT) group is the only publicly documented use of the native messaging API for post-exploitation. This APT group strategically leveraged the native messaging API to facilitate the execution of their _WhiskerSpy_ backdoor, enabling seamless payload delivery and persistent access. In this attack, the malicious browser extension used native messaging to communicate with a local native messaging host, which then executed a shellcode-based loader. The extension initiated an inject command, which, rather than taking direct parameters, automatically connected to a hardcoded URL (http://<delivery server>/help.jpg) to download and decode the main payload. This payload, disguised as an image file (help.jpg), contained shellcode that loaded and executed the WhiskerSpy backdoor [24]. Once deployed, the WhiskerSpy shellcode established a secure communication channel with its C2 server using Elliptic-Curve Cryptography (ECC) for key establishment, ensuring encrypted command execution. The backdoor shellcode provided extensive remote capabilities, including an interactive shell, file manipulation (download, upload, delete, list), screenshot capturing, shellcode injection into other processes, and the ability to load additional executables and execute their exported functions. By using native messaging, Earth Kitsune bypassed browser sandboxing and CSP restrictions, as the malicious extension merely acted as a bridge to the system-level backdoor. This approach enabled persistent access, while remaining largely undetected by traditional browser security mechanisms. Last but not least, the CursedChrome [25] Github repository contains a PoC malicious browser extension designed to turn Chrome into a covert Remote Access Trojan (RAT). Created for educational and research purposes, it allows attackers to gain control over a victim's browser, enabling session hijacking, keylogging, and data exfiltration. Once installed, the extension connects to an attacker-controlled server, granting full access to the victim's web sessions, including the ability to bypass authentication mechanisms and manipulate content in real time. In comparison to WhiskerSpy and CursedChrome, which are the most pertinent prior works to the research presented here, C3 distinguishes itself in several key aspects. While both WhiskerSpy and covert C2 leverage the native messaging API for post-exploitation, their approaches and capabilities differ significantly. WhiskerSpy employs a multi-stage approach, downloading a separate, shellcode-based payload disguised as an image file before executing the actual backdoor. C3, conversely, downloads and executes DLLs directly from the C2 server, streamlining the execution process. Furthermore, WhiskerSpy functions as a full-fledged backdoor, providing a wide range of remote administration capabilities, including an interactive shell, file manipulation, and screenshot capturing. C3, in its current implementation, focuses specifically on command execution and data exfiltration, although its functionality can be extended by the DLLs it executes. The security of C3 relies on HTTP/3 over QUIC security services, which are generally accepted to be robust [26; 27]. Finally, the native application's role also varies.