Rapuncel stealer exfiltration POST /upload to 2.26.126.50

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•0

Detects outbound network traffic to a known malicious IP address associated with Rapuncel Stealer, specifically looking for HTTP POST requests to the /upload endpoint, indicating possible data exfiltration.