FakeGit - StealC Browser Module Detected

Brandon Rodriguez@BMRodriguez

•updated Mar 6, 2026•3•0•60

This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash.