Exfiltration to Sendit.sh via cURL

Kaung Khant Ko@kaungkhantko

•updated May 27, 2026•0•107

Detects the use of curl.exe to upload files to sendit.sh, indicative of staging stolen data to a public file-transfer service as observed in Seedworm campaigns.