byt3bl33d3r/gcat

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

1351 stars · 416 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Gcat is a proof-of-concept Python backdoor that uses a Gmail account as its command-and-control channel, with an implant deployed on targets and a controller script for issuing commands. It was released so organizations can test defenses against this class of covert C2 communication.

Use cases

• test network defenses against Gmail-based C2 backdoors
• demonstrate covert command-and-control over email in red team exercises
• evaluate detection tooling like RITA against email-based implants
• run remote shell commands on a lab client through Gmail
• retrieve files from an implant host during an authorized pentest

When to choose

• you need a simple PoC to validate email-based C2 detection
• you are doing authorized security research or defense testing
• you want a minimal, readable Python implant for training

When to avoid

• you need a maintained or production-grade C2 framework (the author points to GDog instead)
• you require stealth features, encryption, or modern evasion capabilities
• any use without explicit authorization from the target's owner

Facets

application · maturity abandoned

security penetration-testing security penetration-testing python windows backdoor c2 command-and-control gmail proof-of-concept red-team linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="byt3bl33d3r/gcat")