CryptoBandits screenshot/seed phrase exfiltration via curl Tor SOCKS5 to /recvf.php

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•3

Detects the use of 'curl.exe' with specific command-line arguments indicating a SOCKS5 proxy connection to 'localhost:9050' and a request to '/recvf.php'. This pattern is often associated with malware or adversary activity attempting to exfiltrate data or establish C2 communications through a local SOCKS proxy, potentially part of a multi-hop proxy chain.