Djinn Stealer HTTPS C2 Exfiltration via telemetry-client/1.0 User-Agent

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects network activity associated with the Djinn Stealer malware, including connections to a known C2 IP address/port, the use of a specific 'telemetry-client/1.0' user agent, or HTTP POST requests to 'application/octet-stream' endpoints originating from suspicious parent processes such as SimpleHelp or TaskWeaver.