All Detections

Tokengrabber Builder Webhook Obfuscation

avatar
Ankit Mehta@Secvyn
updated 8 days ago000

TokenGrabber Builder: Webhook XOR/Base64 Obfuscation Artifacts - detects webhook.txt persistence, XOR 0x5A + Base64 webhook obfuscation, WEBHOOK_PLACEHOLDER injection, and the _x() decode routine used to recover the exfiltration endpoint

YARA