MayaBot dropper delivery via reficon.pro download.php endpoint

Seb Cantar@sebcantar

•updated Aug 27, 2026•1•0•3

This rule detects suspicious file downloads initiated by common browsers from a specific remote domain ('reficon.pro') associated with '/vizio.com/'. It enriches this activity by checking for prior beaconing activity to 'stats.us3.org' (often used for Matomo analytics), which may indicate a multi-stage attack where an initial profiling beacon precedes a malicious payload download.