DarkSpectre Malicious Browser Extension C2 Activity & Exfil

Kai Johnson@KJohnson

•updated Jan 19, 2026•2•1•105

Detects network connections to domains associated with the DarkSpectre threat actor's campaigns, including GhostPoster, ShadyPanda, and The Zoom Stealer. These campaigns leverage malicious browser extensions for data theft, affiliate fraud, and corporate espionage.