merlin

Establish a covert C2 server and agent using HTTP/3 and DNS transports.

15|1|Updated Feb 12, 2026
One-click install
npx skills add https://github.com/AeonDave/malskill --skill merlin
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: merlin
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/c2/merlin
Command: npx skills add https://github.com/AeonDave/malskill --skill merlin

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a covert Command and Control (C2) server and agent for secure, encrypted communication, designed to evade network inspection.

Core Features & Use Cases

  • Multi-Transport Support: Utilizes HTTP/2 (h2c), HTTP/3 (QUIC), and DNS for flexible and stealthy communication.
  • Cross-Platform: Supports Go-based implants across Linux, macOS, and Windows.
  • Use Case: Deploying an agent on a target system and establishing a C2 channel using HTTP/3 to bypass standard network security monitoring.

Quick Start

Start the Merlin server on your machine using the provided executable and then generate an agent configured to connect to your server's address.

Frequently Asked Questions about merlin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I establish covert C2 communication over HTTP/3?

You can use Merlin for covert C2 over HTTP/3 and DNS. It provides a server and cross-platform Go implants to facilitate encrypted agent communication and post-exploitation activities.

Can I use DNS for command and control traffic to evade network inspection?

Yes, Merlin supports DNS as a transport protocol for C2 communication. It allows agents to route traffic through DNS alongside HTTP/2 and HTTP/3 to evade standard security monitoring.

Do I need Go to compile cross-platform C2 agents?

Yes, Go is required to compile the cross-platform C2 agents. Merlin uses Go-based implants to support agent deployment and management across Linux, macOS, and Windows systems.

What is the best way to manage post-exploitation agents across multiple platforms?

Using a multi-platform C2 framework like Merlin is the best way to manage post-exploitation agents. It supports Go-based implants across Linux, macOS, and Windows for secure agent communication.

Does Merlin support HTTP/2 h2c for stealthy agent communication?

Yes, Merlin supports HTTP/2 (h2c) for stealthy agent communication. It provides multi-transport support including HTTP/2, HTTP/3, and DNS to facilitate secure and flexible C2 channels.