SNOWBELT - Push Notification C2 Wakeup (T1546)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•6

Matches the hardcoded VAPID Public Key string used by the extension to bypass browser sandboxes and wake the service worker, indicative of the SNOWBELT malware's command and control mechanism.