🎯 Application Layer Protocol

The items that name it 13

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29It is written here as Application Layer Protocol: Web Protocols.

  PowerShell and ScreenConnect communicated with actor-controlled infrastructure over HTTP/HTTPS.

• Socket: Malicious Extensions Drain Axiom Trade and Padre Crypto Sessions
  writeup2026-09-12It is written here as Application Layer Protocol: Web Protocols.

  Exfiltration via HTTP requests/navigation to Vercel-hosted and bonto[.]run endpoints

• Socket: "JeetBot" Twitch Extension Steals 31,000 Users' OAuth Tokens
  writeup2026-09-12It is written here as Application Layer Protocol: Web Protocols.

  Token forwarded/POSTed over HTTP(S) to operator-controlled proxy and set-token endpoints.

• Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes
  writeup2026-09-01It is written here as Application Layer Protocol: Web Protocols.

  HTTPS used for C2 communication and exfiltration

• Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands
  writeup2026-08-12It is written here as Application Layer Protocol: DNS.

  104 extensions resolve proxy hostnames via DNS-over-HTTPS (cloudflare-dns.com, dns.google) instead of standard DNS to avoid plaintext queries

• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeup2026-07-23It is written here as Application Layer Protocol: Web Protocols.

  HTTP POST requests used for heartbeat and results exfiltration to C2 API endpoints.

• Socket: Operation Muck and Load
  writeup2026-07-16It is written here as Application Layer Protocol: Web Protocols.

  HTTP/HTTPS communication with dead-drop and payload hosting services.

• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeup2026-07-15It is written here as Application Layer Protocol: Web Protocols.

  HTTP(S) communication to Worker, S3-compatible endpoint, Google Sheets API, and Telegram

• Socket: Chrome and Firefox VPN Extensions Add Clipboard Stealers via Malicious Updates
  writeup2026-06-30It is written here as Application Layer Protocol: Web Protocols.

  Exfiltration performed via HTTP GET requests to hardcoded endpoints using fetch with no-cors mode.

• Socket: 152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic
  writeup2026-06-13It is written here as Application Layer Protocol: Web Protocols.

  Install and uninstall telemetry pings sent over HTTP(S) to operator-controlled domains disguised as normal web/search traffic

• Socket: Malicious NuGet Package Impersonates Sicoob Banking SDK
  writeup2026-05-29It is written here as Application Layer Protocol: Web Protocols.

  Exfiltration performed over HTTPS to a Sentry ingestion endpoint, blending with legitimate telemetry traffic

• Socket: Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor
  writeup2026-05-20It is written here as Application Layer Protocol: DNS.

  C2 beacon uses DNS TXT record lookups to dnslog-cdn-images[.]freemyip[.]com every five minutes

• Socket: 5 Malicious NuGet Packages Target Chinese .NET Developers
  writeup2026-05-07It is written here as Application Layer Protocol: Web Protocols.

  HTTPS POST exfiltration to dns-providersa2[.]com/upload and beacon to /check.