Explorer Connection to Chat APIs (Phantom Stealer)

Thiru N@Iamthiru

•updated Jun 17, 2026•4•0•12

Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.