Oysterloader User Agent Switching Pattern

Tim Peck@timpeck

•updated Feb 12, 2026•3•1•53

Detects a sequence of HTTP requests where the User-Agent shifts from 'WordPressAgent' to 'FingerPrint' within a short time window, a behavior associated with OysterLoader C2 registration and payload retrieval.