UnregStealer - Exfiltration to urlzzz.php endpoint

Ibrahim Saud@tektrix

•updated Jun 19, 2026•1•0•6

Detects network events where a device communicates with the 'urlzzz.php' endpoint, specifically when this communication is correlated with file events involving 'Login Data' or 'Cookies'. This indicates potential exfiltration of browser credentials or session information by the UnregStealer malware.