INFINITERED Credential Harvester Prefix Detection

Ethan Andrews@eandrews

•updated Jun 15, 2026•6•0•48

Detects the unique session ID prefix 'xc32038474a' used by the INFINITERED credential harvester. This malware prepends this string to hide stolen plaintext passwords inside the legitimate REDCap sessions database table, which may appear in process command lines during execution or data handling.