KREMLIN extension exfiltrating browser history via b83fa72d.css

Arnold Chan@slaz

•updated 24 days ago•0•0•1

This rule monitors network traffic for requests directed at a specific domain ('luizestrelhashapr.online') and path ('/google_api/b83fa72d.css'), which is identified in threat intelligence as an indicator of browser history exfiltration.