## 8 Related Work  
To further evade detection, researchers have explored various obfuscation techniques, including encoding stolen data within images, encrypting payloads, or embedding information within seemingly benign web traffic. Such approaches significantly complicate detection by security tools reliant on behavior-based anomaly detection and browser sand \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Feature**} & \multicolumn{5}{c}{**C2**} \\ \cline{2-6}  & **Cobalt** & **Sliver** & **Mythic** & **Havoc** & **C3** \\ \hline
**License** & Commercial & Open-Source & Open-Source & Open-Source & Open-Source \\ \hline
**Language** & C, Java & Go & Python, Go, C\# & C, C++ & C++, JS \\ \hline
**Support** & Windows & Windows, Linux, macOS & Windows, Linux, macOS & Windows & Windows, Linux, macOS \\ \hline
**Payloads** & Reflective & & & & \\  & DLL, Staged/ & Staged/ & Modular, Agent-based & Reflective & DLL, Staged/ \\  & Stagedess & & & & \\  & Stagedess & & & & \\ \hline
**Communication** & HTTP/S, DNS, SMB & HTTP/S, DNS, mTLS, WireGuard & HTTP/S, TCP & HTTP/S, TCP & IPC \\ \hline
**Evasion** & Malleable C2, in-memory execution & Encrypted comms & Modular implants & Direct syscalls, manual mapping & In-memory execution \\ \hline
**Credential Dumping** & Mimikatz, DCSync, Pass-the-hash & Mimikatz & Build-in & Build-in & Build-in \\ \hline
**Lateral Movement** & Pass-the-ticket, SMB, RDP, SSH & SSH, RDP, SMB, DNS & Agent-to-agent pivoting & Named pipes, Token &
\begin{tabular}{c} **Build-in** \\ (SMB, \\ schtasks/runas, \\ curl, etc.) \\ \end{tabular} \\ \hline
**Persistence** & \begin{tabular}{c} Registry, Scheduled Tasks, \\ WMI \\ \end{tabular} & \begin{tabular}{c} Systemd, \\ Cron, \\ Registry \\ \end{tabular} & Custom & \
\begin{tabular}{c} Registry, \\ Process Injection \\ \end{tabular} &
\begin{tabular}{c} **Build-in**, \\ Scheduled Tasks, \\.lnk files \\ \end{tabular} \\ \hline
**Detection** &
\begin{tabular}{c} High (widely \\ used) \\ \end{tabular} & Moderate & Moderate & Moderate & **Low to None** \\ \hline
**Customization** & \
\begin{tabular}{c} Partially with \\ Malleable profiles, \\ scriptable \\ \end{tabular} &
\begin{tabular}{c} High \\ Difficulty \\ \end{tabular} & Moderate & Moderate & **Easy** \\ \hline
**Usability** & \
\begin{tabular}{c} Steep learning \\ curve \\ \end{tabular} & Moderate & Advanced & Moderate &
\begin{tabular}{c} **Easy** (In general), \\ Moderate \\ (lateral \\ movement) \\ \end{tabular} \\ \hline
**ExecutionMethod** & Shellcode & Shellcode & Shellcode & Shellcode &
\begin{tabular}{c} Direct \\ Code \\ Execution \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparative analysis of established C2 frameworks and the proposed C3 solution. boxing [19]. The effectiveness of these attacks depends on the ability to bypass security measures such as Content Security Policies (CSPs), browser sandboxing, and real-time traffic analysis. This section discusses browser post-exploitation techniques explored in previous studies. While much prior work has focused on the specific capabilities of browser extensions, this study leverages the deeper post-exploitation functionality available in Chromium-based browsers, enabling a wider range of OS-level command execution and data exfiltration. Web-based data exfiltration techniques have been extensively studied within the context of browser security. Prior research has demonstrated how attackers can leverage JavaScript-based keyloggers to capture and transmit user inputs in real time from a compromised browser [20]. Furthermore, browser APIs such as WebSockets, Fetch, and XMLHttpRequest have been exploited to exfiltrate stolen data while blending with legitimate traffic, making detection more challenging [21]. Session hijacking remains another significant concern, as attackers can intercept authentication tokens or session cookies to maintain persistent, unauthorized access to web services without triggering security alerts [22].