Axios RAT IE8 User-Agent

Danny Y@zendannyy

•updated Apr 1, 2026•12•0•321

Detects outbound HTTP POST requests using a specific, hardcoded Internet Explorer 8 User-Agent string over a specific port. This combination is highly indicative of the cross-platform RAT deployed via the compromised Axios npm packages.