Possible Infostealer Archive Exfiltration via curl Multipart POST to Known C2 Staging Path with Archive Payload
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
Suricata
