dYdX Malware Hardcoded Tokens Detection

Ethan Andrews@eandrews

•updated Feb 23, 2026•2•0•71

This rule detects the presence of hardcoded tokens associated with the dYdX supply chain attack. These tokens were used for C2 authentication and as an API key for data exfiltration. The rule searches across process command lines, network URLs, network headers, and common security logs for these specific tokens.