🎯 Exfiltration Over C2 Channel

The items that name it 5

• Socket: Malicious Extensions Drain Axiom Trade and Padre Crypto Sessions
  writeup2026-09-12

  Encoded payload sent to threat actor-controlled Vercel deployments and susi[.]bonto[.]run

• Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes
  writeup2026-09-01

  AES-encrypted stolen data uploaded via HTTPS POST /upload to rotating pool of C2 domains

• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeup2026-07-23

  Stolen credentials and scan results exfiltrated to threat actor-controlled C2 server via github-results endpoint.

• Socket: Chrome and Firefox VPN Extensions Add Clipboard Stealers via Malicious Updates
  writeup2026-06-30

  Clipboard chunks sent with uid, part, total, and data query parameters to /html/continue.php endpoints on threat-actor infrastructure.

• Socket: Malicious NuGet Package Impersonates Sicoob Banking SDK
  writeup2026-05-29

  Stolen client ID, PFX password, and base64-encoded PFX contents sent through Sentry as the exfiltration channel