CornFlake Localhost HTTP API Server (/upload, /reload, /status) Companion Payload Tasking

Duo Tech@duotech

•updated Aug 6, 2026•2•0•3

Detects a companion payload masquerading as svchost32.exe that exposes a localhost HTTP API with /upload, /reload, or /status endpoints, consistent with CornFlake's modular C2 tasking behavior.