Skip to content

Multi-channel exfiltration

Named by 2 kept items in this workspace.

Search every workspace for Multi-channel exfiltration. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • kaandemir993/DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis
    repo2026-09-05

    Exfiltrates stolen data via Telegram Bot API (api.telegram.org/bot with StrBotToken and ChatID), SMTP email (CDO.Message, mail.mfcgroups.com, smtpserver, sendusername, sendpassword), and FTP (GateUrl, StrFtpUser)

  • Nx Console VS Code Extension Compromised
    writeup2026-06-02

    Data buffered to 102,400-byte threshold then exfiltrated via HTTPS POST to encrypted C2 domain, GitHub API (commits/artifacts on victim's own repos), and DNS tunneling; hybrid AES-256-GCM + RSA-OAEP/SHA-256 encryption, zlib compressed

All techniques in this workspace.