Generating title...

Matt Brady@mbrady5299

•updated Mar 23, 2026•0•35

Detects .NET infostealer ('AI Theater') binaries containing specific custom HTTP headers (X-LLM-Enhanced, X-Message) and hardcoded C2 infrastructure used for exfiltration.