🎯 T1041 Exfiltration Over C2 Channel

The items that name it 2

• Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets
  writeup2026-10-27It is written here as T1041 Exfiltration Over C2 Channel: JSON POSTs to brand-named bonto[.]io subdomains behind Cloudflare, with XMLHttpRequest fallback.
• GhostAction Attack Escalates By Targeting GitHub Users
  writeup2026-10-09It is written here as T1041 Exfiltration Over C2 Channel (Exfiltration).

  Exfiltration