Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2

Zscaler ThreatLabz discovered a Tropic Trooper campaign that distributes a trojanized SumatraPDF to show a decoy document while fetching encrypted shellcode to launch an AdaptixC2 Beacon. The attack chain uses a Xiangoop-derived loader (TOSHIS) to drop the beacon and lure, leverages GitHub as a C2 channel, and—after validating target value—installs VS Code and sets up VS Code tunnels for persistent remote access; staging infrastructure has also hosted Cobalt Strike and a custom backdoor (EntryShell).