Inside Canis C2: The ‘Wide Open’ Surveillance Engine Targeting Every Major OS

Hunt.io discovered Canis C2, a sophisticated cross-platform surveillance system whose unauthenticated public API exposed payloads, command logs, and source code; initial detection came from an Android APK impersonating Paidy and operators later moved to a new phishing domain using AitM techniques. The platform targets Android, iOS, Windows, Linux and macOS and supports real-time GPS tracking, camera/microphone capture, credential overlay injection, and persistent remote control, with portions of the codebase showing signs of LLM-assisted development.