VPN Go Clipboard Stealer - Exfiltration URL Pattern

Lourenço Santos@lourenco

•updated Jun 30, 2026•1•0•4

Detects outbound HTTP requests matching the VPN Go clipboard-stealer exfiltration pattern: a request to /html/continue.php carrying the uid, part, total, and data query parameters used to reassemble chunked clipboard contents server-side. URI-pattern based, so it catches infrastructure rotation beyond the known IOC hosts.