WormSocket Creates a WebSocket Forwarder Client

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

Detects a proxy process constructing forwarder-client identifiers and asynchronous queues for bidirectional web socket tunnelling, indicative of WormSocket or similar malware activity.