StealC-style HTTP POST beacon to hardcoded C2 IP 23.227.198.199

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects outbound HTTP POST beaconing behavior to a known C2 IP address associated with the StealC malware and ClickFix campaign. This rule monitors for established connections to the hardcoded infrastructure used for exfiltrating data or receiving commands.