Graphalgo RAT Slack API C2 polling via non-Slack Go HTTP client

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•4

Detects repetitive network traffic to the Slack API endpoint '/api/conversations.history' using the 'Go-http-client' User-Agent. This behavior is indicative of the Graphalgo RAT polling Slack for command-and-control (C2) instructions.