CurlRAT libcurl beaconing via User-token header at 12h/30s intervals

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•0

Detects periodic POST requests to an external endpoint containing specific request parameters (name, value, type) and a 'User-token' header, consistent with the expected beaconing intervals of the curlRAT malware (12h or 30s fast-poll).