Remcos RAT Loader WebRTC IP Leakage Attempt

Ankit Mehta@Secvyn

•updated Jun 23, 2026•3•0•6

Detects attempts by the Remcos RAT loader to perform WebRTC IP leakage by monitoring process command lines for keywords like 'webrtc', 'stun', 'turn', or 'ice' when initiated by common browsers (chrome.exe, firefox.exe, opera.exe) and having a parent process related to 'Remcos'. This indicates an attempt to gather victim IP addresses.