Explorer.exe DNS Requests to Discord/Telegram (Phantom Stealer)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•3•0•13

Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.