ChatGPT Stealer C2 Domains Network Connection

Nicholas Isakson@nisakson2000

•updated Feb 22, 2026•9•0•78

This rule detects network connections from common web browsers to known command and control (C2) domains associated with the ChatGPT Stealer campaign. These domains are used to exfiltrate stolen AI session tokens and conversation data.