Gofile
Named by 3 kept items in this workspace.
Search every workspace for Gofile. It matches the name as written, so it can find other things that share it.
The items that name it 3
File-sharing service abused for exfiltration; stolen data uploaded as password-protected ZIP, resulting link reported to attacker webhook
Legitimate file-upload/hosting service abused by the stealer to upload the password-protected exfiltration ZIP; resulting download link (https://gofile.io/d/<code>) sent to the attacker webhook
file hosting site (gofile[.]io) used by Icarus as a dead-drop to host sample leaked data; default 10-day retention, longer for Premium accounts
All technologies in this workspace.