Slack link previews become a stealth C2 tunnel in locked‑down networks
Researchers show how Slack’s automatic link‑preview fetch lets an implant issue GET requests that bypass corporate proxies, using the preview’s meta description to return commands. The method works even when X‑Slack‑Allowed‑Workspaces‑Requester blocks direct Slack API calls, giving red teams a covert channel in tightly restricted environments.