INFINITERED Credential Harvester Prefix Detection

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•8

Detects the unique session ID prefix 'xc32038474a' used by the INFINITERED credential harvester. The malware prepends this string to hide stolen plaintext passwords inside the legitimate REDCap sessions database table, which can be observed in process command line executions.