convoC2

Command-and-control framework that sends commands in hidden span aria-label attributes in Microsoft Teams messages. Its Windows agent reads the local Teams log, executes received system commands, and returns output through Adaptive Card image URLs that trigger out-of-band HTTP requests to the C2 server. The documented setup requires Teams to be running, a Teams Workflow incoming webhook, captured chat identifiers and a bearer token, and a public-facing server reachable over HTTP on port 80.