Potential Discord Webhook Exfiltration or C2 (Microstealer)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects network connections to a specific Discord webhook URL and another suspicious domain (78smp.com/m/). This pattern is often associated with malware attempting to exfiltrate data or establish command and control (C2) via Discord webhooks, or other suspicious domains.