DEV#POPPER/OmniStealer Suspicious Inline Execution

Blake Miller@NotNull

•updated Jun 19, 2026•2•1•17

Detects the use of Node.js or Python with inline execution flags (-e or -c) and a long command line, a technique used by DEV#POPPER stagers to run obfuscated code. The rule specifically looks for keywords like 'base64', 'urlopen', 'exec', and 'import' in the command line, which are indicative of malicious script execution.