MOBILE_MALWARE Frogblight WebSocket C2 Authentication

Tim Peck@timpeck

•updated Dec 15, 2025•0•36

This rule detects WebSocket C2 authentication attempts by the Frogblight mobile banking malware. It specifically looks for the hardcoded login key '{"login_key":"fg_a1b2c3d4e5f6"}' within TCP traffic destined for external networks.