OceanLotus SPECTRALVIPER Encrypted Cookie Exfiltration

Kaung Khant Ko@kaungkhantko

•updated Jun 12, 2026•0•0•6

Detects HTTP requests where the Cookie header contains the specific prefixes 'euconsent-v2=' or 'zd_cs_pm=', which are used by the OceanLotus SPECTRALVIPER backdoor to exfiltrate encrypted host profiling data.