TokenGrabber Stealer: StolenData ZIP Exfiltration via Webhook POST

Ankit Mehta@Secvyn

•updated 8 days ago•0•0•0

This rule detects outgoing HTTP POST requests that contain a ZIP file with a filename prefix of 'StolenData_' in the request body. This is a known behavior of the TokenGrabber stealer family, which exfiltrates collected victim data (e.g., browser credentials, session tokens) to a remote server, often via a Discord webhook or similar infrastructure.