EVILBOX C2 is a proprietary, enterprise-grade offensive security platform built for red teams, penetration testers, security consultancies, and internal security operations performing authorized adversary emulation and security validation. It consolidates OSINT, reconnaissance, automated infrastructure setup, BEC and phishing simulation, hidden remote desktop management across all platforms, live deepfake capabilities, campaign orchestration, and executive reporting into a single unified command ecosystem. The platform runs as a self-hosted web application — once installed, operators access a full-featured GUI via their local browser at
localhost. For internet-facing C2 operations, a VPS or on-premises server is required.
EVILBOX C2 is intended exclusively for authorized security testing, adversary emulation, defensive validation, penetration testing, purple team exercises, and cybersecurity research where appropriate authorization has been obtained.
The operator is solely responsible for ensuring all activities comply with applicable laws, organizational policies, and written authorization requirements. Unauthorized use against systems you do not own or have explicit written permission to assess is illegal.
EVILBOX integrates commercial intelligence feeds, proprietary reconnaissance engines, automated infrastructure provisioning, and military-grade C2 capabilities into a unified command ecosystem.
Unlike collections of disconnected tools, EVILBOX provides a single operational workspace for:
[+] Planning and executing authorized security engagements
[+] Running automated C2 infrastructure setup from a local desktop or VPS
[+] BEC simulation — phishing, smishing, spoofing, impersonation
[+] Hidden Remote Desktop management across Windows, Linux, and macOS
[+] Live Video Deepfake engine for advanced social engineering exercises
[+] Built-in paid recon and email intelligence tools — no external subscriptions needed
[+] Multi-domain email setup via a few-click wizard
[+] Direct API integration with supported tools (official and unofficial/scraping methods)
[+] Validating defensive controls and detection coverage
[+] Collecting, storing, and reporting assessment evidence
Access model: After installation, the full EVILBOX command center is accessed through a browser at http://localhost on the operator's machine. For internet-facing C2 operations — managing remote agents, running email campaigns, and receiving callbacks across the internet — a VPS or on-premises server is required. EVILBOX includes a guided setup wizard to provision and configure this infrastructure.
| Audience | Use Case |
|---|---|
| Red Team Operators | Full adversary simulation and APT emulation |
| Purple Team Exercises | Collaborative attack/defense validation |
| Penetration Testing Firms | Structured engagement management and reporting |
| Enterprise Security Teams | Internal security validation and control testing |
| Security Operations Centers | Offensive testing and detection coverage validation |
| Security Consultants | Client assessment workflows end-to-end |
| Offensive Security Researchers | Advanced tooling for authorized research |
| Security Training Environments | Hands-on operator training and education |
EVILBOX is a full-stack platform. The backend handles C2 logic, agent management, and system-level operations in high-performance native languages. The frontend delivers a rich web GUI accessible from localhost after installation — no cloud dependency, no SaaS, fully self-contained. The tool integrates with supported third-party platforms via official APIs and unofficial methods (scraping) where applicable.
| Language | Role |
|---|---|
 Go |
C2 server core, agent framework, concurrency engine, network I/O, REST API layer |
 C |
Low-level agents, memory manipulation, OS interaction, kernel-level modules |
 C++ |
Native endpoint modules, Windows API integration, compiled agent components |
 Python |
Deepfake engine, OSINT automation, email intelligence pipelines, exploit scripting |
 Rust |
High-performance port scanning, binary tooling, memory-safe networking modules |
 Shell / Bash |
Automated infrastructure provisioning, server hardening, deployment scripts |
| Language / Framework | Role |
|---|---|
 TypeScript |
Primary frontend language — type-safe UI logic across all dashboard modules |
 React |
Component-based web GUI — dashboards, campaign views, module panels |
 Tailwind CSS |
Utility-first styling for the operator interface |
 JavaScript |
Client-side logic, real-time WebSocket communications, dynamic UI components |
 HTML5 |
Markup foundation for the web command center and MalPage Studio templates |
| Technology | Role |
|---|---|
 PostgreSQL |
Primary relational database — campaigns, targets, credentials, evidence |
 SQLite |
Lightweight local storage for agent configuration and offline operation |
 Docker |
Container orchestration for modular service deployment |
 Nginx |
Reverse proxy, SSL termination, and local web server for the GUI |
No external cloud dependency for core operation. Every component runs locally — the operator installs once and accesses the full platform at
localhost. A VPS or on-prem server extends the platform to internet-facing C2 operations.
╔═══════════════════════════════════════════════════════════════════════╗
║ EVILBOX C2 — COMMAND CENTER ║
╠═══════════════════════════════════════════════════════════════════════╣
║ ┌───────────────────────┐ ┌─────────────────────────────────────┐ ║
║ │ INTELLIGENCE HUB │ │ INFRASTRUCTURE MANAGER │ ║
║ │ ├ Passive Recon │ │ ├ Automated C2 Infrastructure Setup│ ║
║ │ ├ Active Enum │ │ ├ Domain & DNS Operations │ ║
║ │ ├ Built-in Paid Tools│ │ ├ Server Orchestration (VPS/Cloud) │ ║
║ │ ├ Email Intelligence │ │ ├ Multi-Domain Email Wizard │ ║
║ │ └ Dark Web Monitor │ │ └ Mailbox Farm Management │ ║
║ └───────────────────────┘ └─────────────────────────────────────┘ ║
║ ┌───────────────────────┐ ┌─────────────────────────────────────┐ ║
║ │ WEAPONIZATION CTR │ │ OPERATIONS THEATER │ ║
║ │ ├ Payload Forge │ │ ├ Campaign Command │ ║
║ │ ├ MalPage Studio │ │ ├ BEC & Email Attack Suite │ ║
║ │ ├ Evasion Lab │ │ ├ Smishing / Vishing Delivery │ ║
║ │ ├ Agent Builder │ │ ├ Target Management │ ║
║ │ └ Deepfake Engine │ │ └ Engagement Analytics │ ║
║ └───────────────────────┘ └─────────────────────────────────────┘ ║
║ ┌───────────────────────┐ ┌─────────────────────────────────────┐ ║
║ │ COVERT ACCESS (RDM) │ │ INTELLIGENCE REPOSITORY │ ║
║ │ ├ Windows HRDP │ │ ├ Credential Vault │ ║
║ │ ├ Linux VNC/X11 │ │ ├ Document Library │ ║
║ │ ├ macOS ARD/VNC │ │ ├ Communication Logs │ ║
║ │ ├ Lateral Movement │ │ └ Evidence Locker │ ║
║ │ └ Data Exfiltration │ └─────────────────────────────────────┘ ║
║ └───────────────────────┘ ║
║ ┌─────────────────────────────────────────────────────────────────┐ ║
║ │ COMMAND REPORTING │ ║
║ │ Executive Dashboards │ Technical Findings │ Compliance │ ║
║ └─────────────────────────────────────────────────────────────────┘ ║
╚═══════════════════════════════════════════════════════════════════════╝
│
▼ accessed via browser
┌──────────────────────────────┐ ┌──────────────────────────────┐
│ http://localhost │ ───► │ VPS / On-Prem Server │
│ EVILBOX Web GUI │ │ C2 Agents · Mail Server │
│ React + TypeScript + Nginx │ │ DNS · Redirectors │
└──────────────────────────────┘ └──────────────────────────────┘
Expand — Full Intelligence Capabilities
Built-in Paid Reconnaissance & Email Intelligence Tools
EVILBOX ships with integrations for premium commercial intelligence platforms — no separate subscriptions or API key management required. The tool integrates via official APIs and unofficial methods (scraping) depending on the platform. See the Built-in Paid Tools section for the full list.
Open-Source Tooling
theHarvester · Amass · Subfinder · Sublist3r · Assetfinder · Findomain · Nuclei · Nmap · Masscan · Maltego · VirusTotal · URLScan.io · Wayback Machine CDX · BinaryEdge · Onyphe
Corporate Intelligence Gathering
- Corporate structure mapping — parent companies, subsidiaries, acquisitions
- Leadership and department enumeration with contact intelligence
- Technology stack profiling — CMS, cloud services, security stack, email infrastructure
- Digital footprint analysis — social media, job postings, SEC filings, domain portfolio
- SSL/TLS certificate transparency log analysis
Active Reconnaissance
- Web beacon and client fingerprinting — browser, OS, network, hardware attributes
- Port scanning integration (Masscan, Nmap, Naabu, RustScan)
- Vulnerability assessment integration (Nuclei, Nessus, OpenVAS, Tenable.io)
Dark Web Monitoring
- Tor search engine integration (Ahmia, Kilos, Phobos)
- Breach database access — HaveIBeenPwned, DeHashed, IntelX, Leak-Lookup
- Ransomware group leak site tracking
- Threat intelligence feeds — MISP, OpenCTI, AlienVault OTX, IBM X-Force, MITRE ATT&CK
Expand — Email Security Assessment & Intelligence Capabilities
Email Discovery & Validation
- Pattern recognition and permutation engine for address discovery
- Source aggregation: breach databases, paste sites, GitHub commits, WHOIS, SSL contacts, search engines
- Full validation pipeline: syntax, MX record, SMTP handshake, catch-all detection, honeypot detection, disposable email detection
- Built-in paid email verification tools: NeverBounce, ZeroBounce, EmailRep.io, IPQualityScore — bundled, no external subscription required
Email Security Assessment — DNS Analysis
SPF ─── Record parsing · mechanism evaluation · spoofability checks (-all, ~all, +all, ?all)
DKIM ─── Selector discovery · key strength (1024 vs 2048-bit) · algorithm analysis
DMARC ── Policy extraction (none/quarantine/reject) · reporting config · subdomain policy
Advanced: DNSSEC · MTA-STS · TLS-RPT · BIMI · ARC · DANE
SMTP Security Assessment
- Banner grabbing, STARTTLS, cipher suite analysis, open relay testing, user enumeration (VRFY, EXPN, RCPT TO)
Ideal for hardening Microsoft 365, Google Workspace, Exchange, and custom mail infrastructure.
Expand — Automated C2 Infrastructure Provisioning
EVILBOX includes a fully automated infrastructure setup system that allows operators to turn a local desktop or VPS into a fully operational, production-grade C2 server without manual server configuration or DevOps expertise. For internet-facing operations — including receiving C2 agent callbacks, running email campaigns, and managing remote sessions — a VPS or on-premises server with a public IP is required.
Automated Setup Features
- One-command C2 server initialization from a local machine or VPS
- Automated VPS provisioning across major cloud providers (DigitalOcean, AWS EC2, Azure, GCP, Vultr, Hetzner, Linode, OVH)
- Auto-configured reverse proxies, redirectors, and domain fronting
- Automated SSL/TLS certificate provisioning (Let's Encrypt + commercial)
- SSH hardening, firewall setup (UFW/iptables), and intrusion detection deployed automatically
- Container orchestration via Docker and Kubernetes for scalable deployments
- Full teardown and cleanup capability for operational security
Multi-Domain Email Setup Wizard
Configure professional email infrastructure for multiple domains in a few clicks:
[1] Enter domains to configure
[2] Wizard auto-generates and applies SPF, DKIM, DMARC, MX records
[3] Connects SMTP relay, mailbox farm, or self-hosted mail server
[4] Validates deliverability across Gmail, Outlook, Yahoo, ProtonMail
[5] Email infrastructure is live and ready for campaigns
- Supports simultaneous setup of multiple sending domains
- Warm-up scheduling configured automatically
- IP rotation and bounce handling set up out of the box
Expand — Business Email Compromise & Email Attack Capabilities
EVILBOX includes a comprehensive, automated BEC and email attack simulation suite covering the full spectrum of email-based social engineering attacks used in authorized engagements.
Supported Attack Types
| Attack Type | Description |
|---|---|
| Phishing | Targeted and mass phishing campaigns with custom templates and payloads |
| Spear Phishing | Highly personalized campaigns built from deep reconnaissance data |
| Smishing | SMS-based phishing via Twilio and other SMS gateways |
| Email Impersonation | Sending as a trusted identity — executive, vendor, IT team |
| Email Spoofing Simulation | Test domain spoofability against SPF/DKIM/DMARC misconfigurations |
| BEC — Executive Fraud | CEO/CFO impersonation for wire transfer and credential scenarios |
| BEC — Vendor Impersonation | Supplier fraud simulation and invoice manipulation campaigns |
| BEC — Finance Targeting | Accounts payable and treasury team awareness exercises |
| Domain Lookalike Campaigns | Typosquat and homograph domains for realistic impersonation |
| Thread Hijacking | Reply-chain injection for high-trust impersonation |
Automation & Advanced Processes
- Automated campaign setup from recon data to delivery in a single workflow
- Persona builder — constructs believable sender identities from OSINT data
- Real-time credential capture with 2FA bypass support (session forwarding)
- A/B testing across subject lines, templates, and sender identities
- Engagement analytics: opens, clicks, replies, credential submissions
- Automated follow-up sequences with conditional logic
- Multi-channel delivery: email, SMS, LinkedIn, Slack, Teams
Hidden Remote Desktop — Windows, Linux & macOS
Expand — Cross-Platform Covert Remote Desktop Management
EVILBOX provides a Hidden Remote Desktop Management (HRDP) module for authorized red team operations and offensive security research across all major operating systems. Sessions are established covertly without triggering standard user notifications.
Windows — Hidden RDP
- Shadow session creation (
mstsc /shadow) — view and interact without alerting the active user - Session hijacking without user notification
- Multi-monitor support, clipboard control, file transfer integration
- Audio capture and playback, keystroke injection
Linux — Hidden VNC / X11
- Hidden VNC server deployment without desktop environment changes
- X11 forwarding tunnel for covert graphical access
- Input injection for automated interaction
- Desktop environment access across GNOME, KDE, XFCE
- Python PTY shell fallback for non-graphical environments
macOS — Hidden ARD / VNC
- Apple Remote Desktop (ARD) manipulation for covert access
- Hidden VNC session without user notification or menu bar icon
- Screen capture without triggering privacy indicators
- Input control (keyboard and mouse injection)
- AppleScript and JXA automation for silent interaction
All HRDP sessions are fully encrypted end-to-end, recorded, logged with complete interaction history, and operator-authenticated per session.
Expand — Real-Time Deepfake for Social Engineering Exercises
EVILBOX includes a Live Video Deepfake Engine purpose-built for authorized social engineering simulation and security awareness testing. This module requires a dedicated GPU server — see Infrastructure Requirements for hardware specifications.
Capabilities
- Real-time face swap during live video calls (Zoom, Teams, Google Meet, WebEx)
- Identity impersonation for authorized executive impersonation exercises
- Voice synthesis integration for full audio-visual persona creation
- Virtual camera output compatible with all major conferencing platforms
- Low-latency processing optimized for live call performance
- Scenario library: IT support impersonation, executive calls, vendor video verification bypass
Use Cases
- Authorized vishing and video social engineering exercises
- Security awareness training demonstrating deepfake threats
- Red team identity impersonation during approved engagements
- Testing organizational verification procedures for video-based communications
GPU Requirement: The Deepfake Engine requires a dedicated GPU with sufficient VRAM to run real-time inference. Minimum 32 GB VRAM; 64 GB VRAM recommended for optimal performance. See Infrastructure Requirements.
Expand — Payload Forge, Evasion Lab & MalPage Studio
Payload Forge — Agent Capabilities
| Platform | Key Capabilities |
|---|---|
| Windows | Hidden RDP shadow sessions · RCE (PowerShell, CMD, .NET assembly) · persistence (registry, scheduled tasks, WMI, services, startup) · AMSI bypass · ETW patching · process injection · credential dumping (LSASS, SAM) · keylogging · clipboard monitoring · browser data extraction |
| Linux | Hidden VNC/X11 · reverse shells (bash, Python PTY, socat) · cron/systemd persistence · LD_PRELOAD hooks · privilege escalation enumeration · SSH key harvesting · database access · log collection |
| macOS | Hidden ARD/VNC · AppleScript/JXA execution · LaunchAgent/LaunchDaemon persistence · Dylib hijacking · Keychain extraction · Gatekeeper/XProtect/TCC evasion · iCloud token extraction · Safari/Notes data |
Evasion Lab
- Document-based: VBA macro obfuscation · DDE · Excel 4.0 XLM macros · OLE embedding · template injection · PDF JavaScript · ISO/IMG payloads with Unicode RLO extension spoofing
- Binary: UPX/Themida/VMProtect packers · custom crypters · polymorphism · metamorphism · steganography
- LOLBAS: certutil · mshta · rundll32 · regsvr32 · PowerShell (Windows) · /dev/tcp · Python · Perl · AWK (Linux) · osascript · ruby (macOS)
MalPage Studio — Template library for authorized social engineering exercises:
- Corporate: Microsoft 365 · Google Workspace · VPN portals (Cisco, Palo Alto, Fortinet, SonicWall) · OWA · HR systems (Workday, ADP, BambooHR) · file sharing (Dropbox, Box, OneDrive) · collaboration (Slack, Teams, Zoom, WebEx)
- Consumer: Banking portals · Social media · E-commerce · Streaming · Gaming platforms
- Advanced: 2FA bypass with real-time session forwarding · EvilQR · Browser-in-the-Browser · MitM proxy
Expand — Campaign Command & Analytics
Campaign Types
[A] Spear Phishing — Personalized, deep recon-driven, custom payload per target
[B] Mass Phishing — Volume delivery, template rotation, A/B testing, auto follow-ups
[C] Smishing — SMS-based campaigns via Twilio and SMS gateway integrations
[D] Watering Hole — Compromised site payload injection, target visit profiling
[E] Cred Harvesting — Login portal cloning, real-time session and token capture
[F] BEC Campaigns — Executive/vendor impersonation, thread hijacking, invoice fraud
[G] Vishing + Deepfake — Voice and video-based impersonation in authorized exercises
Target Management
- Psychological profiling based on OSINT-derived social media data (OCEAN model)
- Technical sophistication and access privilege level estimation
- Segmentation: department · location · seniority · OS environment · device type
Delivery Systems
- Direct SMTP · SendGrid/Mailgun/AWS SES · Microsoft Graph API · Gmail API · Webmail automation
- Alternative vectors: LinkedIn messaging · SMS/Twilio · Slack/Teams · social media DMs
Engagement Analytics
- Real-time delivery, engagement, compromise, and behavioral metrics
- Geographic heatmap · timeline view · conversion funnel · click pattern analysis
Expand — Endpoint Management, Lateral Movement & Exfiltration
Endpoint Classification
By OS: Windows (7/8/10/11/Server) · Linux (Ubuntu/CentOS/Debian/RHEL) · macOS
By Access: User --> Administrator --> SYSTEM/Root --> Domain Admin
By Network: External · Internal · DMZ · Jump Host (pivot points)
By Status: Active (regular callbacks) · Dormant (sleeper) · Lost (no recent contact)
Lateral Movement
- Pass-the-Hash · Pass-the-Ticket · Token Impersonation · SSH Key Hijacking · RDP Hijacking · WMI/PSExec · WinRM · SMB
Network Pivoting
- SOCKS proxy · reverse port forwarding · HTTP tunnel · DNS tunnel
Data Exfiltration
- Direct HTTPS · encrypted TLS · steganography · cloud upload (OneDrive, Dropbox, GDrive) · DNS exfiltration · ICMP tunnel
Expand — Credential Vault, Evidence & Logs
- Credential Vault: AES-256 encrypted storage · hash type detection · Hashcat/John integration · credential pairs, hashes, Kerberos tickets, OAuth tokens, PFX/PEM certs
- Document Library: Screenshots · exfiltrated documents · database dumps · config files · email archives · session recordings
- Communication Logs: Email threads · Slack/Teams logs · terminal transcripts · audio recordings
Expand — Dashboards, Findings & Compliance
- Executive Dashboards: Risk scoring · visual attack path · campaign timeline · industry benchmarking
- Technical Findings: CVE references · CVSS scoring · step-by-step PoC · remediation instructions
- Compliance: MITRE ATT&CK · NIST CSF · ISO 27001 · PCI DSS · HIPAA · GDPR
Expand — AI Features
- GPT-powered phishing and BEC email generation tailored to target personas
- Report drafting assistance for executive and technical deliverables
- Sentiment analysis for target profiling from social media data
- Multi-language campaign generation and translation
- Automated attack chain: Recon → Weaponize → Deliver → Exploit → Persist
- SIEM integration: Splunk · ELK · QRadar · Sentinel
- EDR validation: CrowdStrike · Carbon Black · Microsoft Defender
EVILBOX bundles access to the following premium commercial platforms and paid intelligence services. No external accounts, API keys, or separate subscriptions are required — access is included with your EVILBOX license. Integration is handled via official APIs and, where applicable, unofficial methods (scraping).
| Tool | Category | Integration | Capability |
|---|---|---|---|
| Hunter.io | Email Intel | Official API | Email pattern discovery, verification, confidence scoring |
| Apollo.io | Contact Intel | Official API | Employee data, contact enrichment, B2B prospecting |
| ZoomInfo | B2B Intel | Official API | Enterprise contact database, org charts, technographic data |
| Clearbit | Company Intel | Official API | Company and person enrichment, tech stack reveal |
| FullContact | Identity Intel | Official API | Person/company enrichment, social profiles |
| Crunchbase | Corporate Intel | Official API | Company funding, leadership, acquisition history |
| LinkedIn Sales Navigator | OSINT | Unofficial (scraping) | Employee enumeration, org profiling |
| RocketReach | Contact Intel | Official API | Email and phone discovery, real-time lookup |
| Lusha | Contact Intel | Official API | Direct phone numbers and email extraction |
| ContactOut | Contact Intel | Official API | Bulk email and phone lookup |
| Snov.io | Email Intel | Official API | Email finder and verifier |
| Pipl | Identity Intel | Official API | Identity resolution and cross-source person lookup |
| Spokeo | People Search | Unofficial (scraping) | People search and contact aggregation |
| Tool | Category | Integration | Capability |
|---|---|---|---|
| NeverBounce | Email Validation | Official API | Bulk and real-time email validation |
| ZeroBounce | Email Validation | Official API | Email verification plus activity scoring |
| DeBounce | Email Validation | Official API | Email list cleaning and bounce detection |
| EmailRep.io | Email Reputation | Official API | Email reputation and risk scoring |
| Voila Norbert | Email Finder | Official API | Email discovery and verification |
| IPQualityScore | Fraud Detection | Official API | Email risk, proxy/VPN detection, fraud scoring |
| Tool | Category | Integration | Capability |
|---|---|---|---|
| Shodan | Asset Discovery | Official API | Internet-connected device search and fingerprinting |
| Censys | Attack Surface | Official API | Host, port, and certificate intelligence |
| SecurityTrails | DNS Intel | Official API | DNS and domain history, passive DNS |
| DomainTools | Domain Intel | Official API (Iris) | Domain intelligence, WHOIS history |
| Recorded Future | Threat Intel | Official API | Real-time threat intelligence feeds |
| BinaryEdge | Attack Surface | Official API | Attack surface mapping and vulnerability discovery |
| RiskIQ / Microsoft | Attack Surface | Official API | PassiveTotal — external threat intelligence |
| Fofa | Asset Discovery | Official API (Pro) | Global asset search engine |
| Onyphe | Cyber Defense | Official API | Cyber defense search engine and threat data |
| Tool | Category | Integration | Capability |
|---|---|---|---|
| DeHashed | Breach Data | Official API | Credential and breach database search |
| IntelX | Breach / OSINT | Official API | Historical breach data, paste site monitoring |
| HaveIBeenPwned | Breach Data | Official API | Email and domain breach lookup |
| Leak-Lookup | Breach Data | Official API | Breach data aggregation and search |
EVILBOX runs locally for the web GUI, but real-world offensive operations — C2 agent callbacks, email campaign delivery, and internet-facing services — require dedicated external infrastructure. The built-in Setup Wizard guides you through provisioning all of this.
A VPS or on-premises server with a dedicated public IP address is required to:
- Receive callbacks from C2 agents deployed across the internet
- Host mail servers for outbound and inbound email campaigns
- Run redirectors, domain fronting, and reverse proxies
- Serve MalPage phishing pages and credential capture endpoints
Recommended VPS providers: DigitalOcean · Vultr · Hetzner · OVH · AWS EC2 · Azure · Linode
Note: Before setting up a mail server, confirm with your VPS or hosting provider that SMTP (port 25/465/587) and IMAP/POP3 (port 143/993/110/995) ports are open and not blocked. Many providers block these ports by default. Some providers require a support request to unblock them.
Recommended VPS Specifications:
| Spec | Minimum | Recommended |
|---|---|---|
| CPU | 4 vCPUs | 8+ vCPUs |
| RAM | 8 GB | 16 GB+ |
| Storage | 100 GB SSD | 500 GB NVMe SSD |
| Network | 100 Mbps, dedicated IP | 1 Gbps+, multiple IPs |
| OS | Ubuntu 22.04 LTS | Ubuntu 22.04+ LTS |
The Live Video Deepfake Engine requires a dedicated GPU server for real-time inference. This can be a local workstation with a supported GPU, a cloud GPU instance (AWS p3/p4, GCP A100, Vast.ai), or an on-premises GPU node.
| Spec | Minimum | Recommended |
|---|---|---|
| GPU VRAM | 32 GB | 64 GB |
| GPU | NVIDIA RTX 3090 / A5000 | NVIDIA A100 / H100 / RTX 4090 |
| System RAM | 32 GB | 64 GB+ |
| CPU | 8 cores | 16+ cores |
| Storage | 200 GB NVMe | 500 GB+ NVMe |
| CUDA | 11.8+ | 12.x |
| OS | Ubuntu 22.04 | Ubuntu 22.04+ |
The Deepfake module can be run on a separate GPU node from the main C2 server. EVILBOX connects to the GPU server over an encrypted channel — the operator can run inference remotely without requiring the GPU machine to be co-located.
EVILBOX provides a guided setup flow for teams and researchers who want to run operations from on-premises hardware instead of cloud VPS. The built-in wizard covers:
[1] Hardware provisioning recommendations
[2] OS installation and hardening (Ubuntu 22.04+ LTS)
[3] Network configuration — static IP, port forwarding, firewall rules
[4] DNS setup — pointing your domain to the on-prem server
[5] SSL/TLS certificate provisioning
[6] EVILBOX C2 server deployment and configuration
[7] Mail server setup (SMTP + IMAP) with port verification guidance
[8] GPU server configuration for the Deepfake Engine
| Operating System | Architecture | Binary | Format |
|---|---|---|---|
| Windows 10 / 11 | x86-64 | EVILBOX.exe |
Inside encrypted 7z archive |
| Debian / Ubuntu 22.04+ | x86-64 | evilbox.deb |
Inside encrypted 7z archive |
| macOS Intel | x86-64 | EVILBOX.pkg |
Inside encrypted 7z archive |
| macOS Apple Silicon | ARM64 | EVILBOX.pkg |
Inside encrypted 7z archive |
The encrypted 7z archive is available in this repository. Contents:
EVILBOX.7z <── password-protected, available for download in this repository
└── EVILBOX/
├── EVILBOX.exe ← Windows binary
├── evilbox.deb ← Debian/Ubuntu package
├── EVILBOX.pkg ← macOS installer (Intel + Apple Silicon)
├── README.md
├── CHANGELOG.md
└── LICENSE.txt
The 7z archive is publicly downloadable from this repository. The extraction password is not published anywhere. All binaries, the license file, and platform installers are sealed inside the encrypted archive. Contact @quantumcoders on Telegram after verification to receive the extraction password.
Operator Workstation (local machine running EVILBOX):
| Spec | Minimum | Recommended |
|---|---|---|
| CPU | 4 cores | 8+ cores |
| RAM | 8 GB DDR4 | 16 GB+ DDR4 |
| Storage | 100 GB SSD | 500 GB NVMe SSD |
| OS | Windows 10 / Ubuntu 22.04 / macOS | Ubuntu 22.04+ LTS |
| Browser | Chrome 90+ / Firefox 88+ / Edge 90+ | Latest Chromium / Firefox |
For GPU (Deepfake) and VPS (C2/Mail) requirements, see Infrastructure Requirements.
The 7z archive is in this repository. Download it, then contact @quantumcoders on Telegram to receive the extraction password after verification. Passwords are never distributed through GitHub Issues, email, Discord, or any other channel.
# 1. Download EVILBOX.7z from this repository
# 2. Contact @quantumcoders on Telegram — complete verification to receive the password
# 3. Extract the 7z archive using your issued password
# 4. Navigate to the extracted EVILBOX/ folder
# 5. Launch:
EVILBOX.exe
# 6. Open your browser and go to: http://localhost
# The EVILBOX web GUI loads automatically
# Note: Administrator privileges may be required for certain modules# 1. Download EVILBOX.7z from this repository
# 2. Contact @quantumcoders on Telegram — complete verification to receive the password
# 3. Extract the 7z archive using your issued password
# 4. Install the Debian package:
sudo dpkg -i evilbox.deb
sudo apt --fix-broken install
# 5. Launch:
evilbox
# 6. Open your browser and go to: http://localhost# 1. Download EVILBOX.7z from this repository
# 2. Contact @quantumcoders on Telegram — complete verification to receive the password
# 3. Extract the 7z archive using your issued password
# 4. Double-click EVILBOX.pkg → follow the installation wizard
# 5. If Gatekeeper prompts you:
# System Settings → Privacy & Security → Allow EVILBOX
# 6. Launch EVILBOX from Applications/
# 7. Open your browser and go to: http://localhost
# Supports both Intel and Apple Silicon natively1. Launch EVILBOX — it starts a local web server on your machine
2. Open your browser and navigate to: http://localhost
3. Sign in using your initial activation credentials
4. Change the default password immediately on first login
5. Configure:
├── Operator profile
├── Server settings
├── Domain configuration
├── SSL certificates
└── Workspace preferences
6. Use the Setup Wizard to provision your VPS, DNS, and C2 environment
7. All modules are available from the web command center once setup is complete
EVILBOX includes a built-in Setup Wizard that walks teams, red teamers, and security researchers through every infrastructure configuration step. No DevOps or systems administration experience required.
The wizard covers:
Expand — Full Setup Wizard Coverage
DNS Configuration
[1] Register a domain (recommendations provided)
[2] Point domain to your VPS or on-prem server IP
[3] Configure A, CNAME, MX, TXT records
[4] Set up SPF, DKIM, DMARC for email operations
[5] Configure subdomains for C2, mail, and phishing infrastructure
[6] Validate DNS propagation before proceeding
VPS Setup
[1] Select and provision a VPS from supported providers
[2] OS installation and initial hardening (automated)
[3] SSH key configuration and password-based auth disabled
[4] UFW/iptables firewall rules applied automatically
[5] Fail2ban, OSSEC, and monitoring tools deployed
[6] EVILBOX C2 server deployed and linked to your local instance
On-Premises Server Setup
[1] Hardware requirements and OS installation guide
[2] Static IP and port forwarding configuration
[3] Internal network routing and firewall setup
[4] NAT traversal and external reachability testing
[5] EVILBOX C2 server deployment
Networking
[1] Port requirements overview
[2] Firewall rules for C2, mail, and phishing operations
[3] Redirector setup for operational security
[4] Domain fronting configuration
[5] OPSEC recommendations for infrastructure
GPU Server (Deepfake Module)
[1] GPU hardware or cloud instance selection guide
[2] CUDA and driver installation
[3] Deepfake model initialization
[4] Connection of GPU node to EVILBOX
[5] Live video feed testing and latency tuning
EVILBOX supports setting up a self-hosted email server allowing operators to send campaigns from their own domain and receive incoming mail via IMAP for full inbox monitoring during authorized engagements.
Important — Port Requirements: Before configuring a self-hosted email server, confirm with your VPS or hosting provider that the following ports are open and not blocked:
Outbound (SMTP):
Port 25 — Standard SMTP relay (often blocked by cloud providers by default)
Port 465 — SMTPS (SMTP over SSL)
Port 587 — SMTP with STARTTLS (submission — most commonly used)
Inbound (IMAP / POP3):
Port 143 — IMAP (plaintext / STARTTLS)
Port 993 — IMAPS (IMAP over SSL)
Port 110 — POP3 (plaintext)
Port 995 — POP3S (POP3 over SSL)
Many VPS providers (AWS, DigitalOcean, GCP) block port 25 by default to prevent spam. You may need to submit a support request to your provider to unblock outbound SMTP. Some operators use port 587 exclusively to avoid this restriction.
Email Server Capabilities
- Use your own domain for outbound email sending
- Full SMTP relay configuration for campaign delivery
- IMAP inbox setup for incoming email monitoring during engagements
- Multi-domain support — run multiple sender domains simultaneously
- SPF, DKIM, DMARC records auto-generated and applied by the Setup Wizard
- Warm-up scheduling and reputation management built in
- TLS encryption enforced for all mail transport
Supported Self-Hosted Mail Stacks
EVILBOX automates deployment and configuration of the following:
| Stack | Notes |
|---|---|
| Postfix + Dovecot | Industry-standard SMTP + IMAP, recommended for most setups |
| Postfix + Roundcube | SMTP with webmail interface |
| Haraka | Node.js-based SMTP for high-volume sending |
| Custom SMTP relay | Bring your own relay — EVILBOX configures routing |
EVILBOX includes a built-in secure update mechanism. No reinstall required for future releases.
[+] Periodically checks for authorized releases
[+] In-app notifications for verified license holders
[+] Updates downloaded and applied automatically
[+] Configuration, workspaces, and projects preserved across migrations
[+] Only licensed installations receive official updates
- The 7z archive is available for download in this repository — binaries, license, and all platform installers are inside
- The archive is password-protected — the extraction password is never published here or on any public channel
- This repository does not contain source code in any form
- Access to the extraction password requires completing the manual verification protocol via Telegram
The 7z archive is downloadable from this repository. The extraction password is issued only after manual verification through the official Telegram channel.
Information typically requested during verification:
[>] Full legal name
[>] Company or organization (if applicable)
[>] Professional email address
[>] LinkedIn profile URL
[>] Intended professional use case
[>] Security research or red team background
[>] Enterprise deployment requirements (if applicable)
Access workflow:
Step 1 ──► Download EVILBOX.7z from this repository
Step 2 ──► Message @quantumcoders on Telegram
Step 3 ──► Complete manual verification
Step 4 ──► Receive approval + unique license credentials
Step 5 ──► Receive extraction password for the 7z archive
Step 6 ──► Extract, install, activate, and access at http://localhost
| Permitted | Prohibited |
|---|---|
| Install on systems you own or are authorized to assess | Redistribute or mirror the 7z archive or extracted binaries |
| Use during authorized penetration tests | Share the extraction password publicly or privately |
| Use in red team or purple team exercises | Sell, repackage, or publish modified binaries |
| Use inside security labs and approved environments | Reverse engineer, decompile, or disassemble the application |
| Attempt to reconstruct or recover source code from any binary | |
| Remove or circumvent licensing or activation systems | |
| Create derivative works from any EVILBOX component | |
| Claim ownership of EVILBOX intellectual property |
Reverse Engineering Policy: By downloading and extracting the archive, you explicitly agree not to reverse engineer, decompile, disassemble, or attempt to reconstruct source code from any EVILBOX binary. Violation results in immediate license termination.
Password Policy: The extraction password issued to you must never be shared publicly or privately. Redistribution requires explicit written permission from the developer. Violation results in immediate access revocation.
| Included | Details |
|---|---|
| Lifetime ownership | Of the purchased major version |
| Unlimited installs | For the licensed owner, per license terms |
| Official release access | For the purchased major version |
| All built-in paid tool integrations | Bundled — no external subscriptions needed |
| Bug fixes | Included |
| Security updates | Included |
| In-app update delivery | Automatic — no reinstall required |
Major version upgrade pricing is communicated directly through official support channels.
Payment is accepted in cryptocurrency only. Contact @quantumcoders on Telegram to initiate a purchase and receive the current wallet addresses for your chosen payment method.
| Network | Currency | Notes |
|---|---|---|
| TRON (TRC20) | USDT | Recommended — fast confirmations, low fees |
| Ethereum Mainnet | ETH | Standard Ethereum network |
| Bitcoin Mainnet | BTC | Bitcoin network |
Wallet addresses are provided directly by @quantumcoders on Telegram at the time of purchase. Do not send payment to any address found outside of a direct, verified conversation with the official account. @quantumcoders is the only authorized point of sale for EVILBOX.
Issues, bug reports, and feature requests are welcomed and reviewed by the EVILBOX development team.
To report a bug or request a feature:
- Open a GitHub Issue in this repository
- Use a clear, descriptive title
- For bugs — include your OS, EVILBOX version, steps to reproduce, and expected vs. actual behavior
- For feature requests — describe the use case and the problem it solves
[!] Bug report → For reporting bugs
[+] Feature request → To request a feature you'd like us to bring to EvilBox
[?] Question → For questions and concerns
All issues are reviewed and attended to as soon as possible. For urgent or security-critical bugs, contact @quantumcoders directly on Telegram. Do not open issues containing extraction passwords, license keys, or any sensitive credential material.
Licensing · Password issuance · Purchase & payment · Enterprise deployment · Verification · Update support
All handled exclusively through @quantumcoders on Telegram.
No extraction passwords, wallet addresses, or license credentials are distributed through GitHub Issues, email, Discord, or any unofficial channel.
EVILBOX C2 is proprietary software. Unauthorized redistribution, reverse engineering, decompilation, password sharing, source code reconstruction, or distribution of modified binaries is strictly prohibited without prior written permission from QuantumCoders.