Browser Network Connection to Known C2 Domains for Malicious 'ChatGPTStealer' Extension

Zachary McManus@CrimZM

•updated Jan 15, 2026•59•1•320

This rule detects common chromium browser processes establishing outbound network connections to known C2 domains associated with malicious 'ChatGPTStealer' infostealer extension. Detections by this rule indicates a high likelihood that a malicious chromium infostealer extension is currently or had been installed on an endpoint.