Shai-Hulud HackBrowserData download from C2 and execution on host

Adarsh Pandey@Pandeyadarsh

•updated today•5•0•4

Correlates a Node.js, Bun, or scripting runtime process communicating with a known C2 domain (iseekaigogo.com) with the execution of the HackBrowserData credential theft tool on the same device within a 30-minute window.